Skip to main content

​
Google Places

Address autocomplete on the signup and billing-address forms. This key is delivered to every browser that loads those forms — that is how the Places JavaScript library works — so it is public by design, and the restrictions in step 1 are the only thing between it and someone else’s billing. Scope: Global defaults only.

​
1. In Google Cloud

  1. APIs & Services → Library → enable the Places API (and Maps JavaScript API if your forms load the JS widget).
  2. Credentials → Create credentials → API key.
  3. Edit the key immediately:
    • Application restrictions → Websites → add every hostname that renders the forms, including staging.
    • API restrictions → Restrict key → select only the Places API (and Maps JavaScript API if enabled).
  4. Set a budget alert on the project.
  5. Copy the key (AIza…).

​
2. Enter it in KnoxCall

Settings → Integrations → Global defaults → Google Places → Configure: Save credentials. The key is stored encrypted like every other secret, and served to the forms at load time.

​
3. Verify

Open the signup address field and type three characters — suggestions mean the key is live and the referrer is allowed. No suggestions with no error usually means a referrer restriction that does not include this host.

​
Things that bite

  • An unrestricted key here is a billing-theft vulnerability, not a theoretical one. Restrict it before saving it.
  • Every host that renders the form must be in the referrer list, or autocomplete silently returns nothing there.
  • Environment fallback: GOOGLE_PLACES_API_KEY is used on a self-hosted host when no row is stored.