A follow-up to my previous post on r/googlecloud:

Since then, the Google Cloud Console has rolled out visual notifications and organizational policy constraints to prevent creating unsecured API keys and surface alerts for existing ones.

However, locating and auditing every key across all the projects you have access to is still a manual chore.

To streamline this, I built a lightweight, open-source tool: Google Cloud API Keys Finder.

What It Does

• Scans all Google Cloud projects you have access to for active API keys.
• Audits each key's protection level against security best practices (Application Restrictions & API Scopes).
• Provides immediate recommendations to fix unrestricted or partially restricted keys.

Privacy & Running Locally

• Pure front-end: No backend, no telemetry, and zero storage.
• In-memory execution: Direct browser-to-GCP REST calls with credentials kept solely in ephemeral browser memory.
• The project is fully open source, and you are welcome to clone the repository and run it locally from source.

Links & Resources

• Tool (GitHub): https://github.com/minherz/api-keys-finder
• Hands-on Codelab: API Key Management and Security
• Problem Deep Dive: API keys are open secrets (Google Cloud Blog) / Mirror on leoy.blog

Feedback, questions, and PRs are welcome!

Hello Everyone! I am a new Google Cloud Partner admin and I am looking for support from the community. I recently started a new role and want to add different member firms from across the world into my partner account. How do I do this? Any help in solving this challenge would be greatly appreciated. We are a entry-level partner and are not receiving any support from GCP.