> ## Documentation Index
> Fetch the complete documentation index at: https://docs.knoxcall.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Google Places

> The Google Maps Platform key behind address autocomplete on KnoxCall's signup and address forms — enable the Places API, restrict the key to your hostnames, and understand that this key is served to browsers by design.

# Google Places

Address autocomplete on the signup and billing-address forms. **This key is delivered to every browser that loads those forms** — that is how the Places JavaScript library works — so it is public by design, and the restrictions in step 1 are the only thing between it and someone else's billing.

**Scope: Global defaults** only.

## 1. In Google Cloud

1. **APIs & Services → Library** → enable the **Places API** (and **Maps JavaScript API** if your forms load the JS widget).
2. **Credentials → Create credentials → API key**.
3. **Edit the key immediately**:
   * **Application restrictions → Websites** → add every hostname that renders the forms, including staging.
   * **API restrictions → Restrict key** → select only the Places API (and Maps JavaScript API if enabled).
4. Set a **budget alert** on the project.
5. Copy the key (`AIza…`).

## 2. Enter it in KnoxCall

**Settings → Integrations → Global defaults → Google Places** → *Configure*:

| Field       | Value   |
| ----------- | ------- |
| **API key** | `AIza…` |

**Save credentials.** The key is stored encrypted like every other secret, and served to the forms at load time.

## 3. Verify

Open the signup address field and type three characters — suggestions mean the key is live and the referrer is allowed. No suggestions with no error usually means a referrer restriction that does not include this host.

## Things that bite

* **An unrestricted key here is a billing-theft vulnerability, not a theoretical one.** Restrict it before saving it.
* **Every host that renders the form must be in the referrer list**, or autocomplete silently returns nothing there.
* **Environment fallback**: `GOOGLE_PLACES_API_KEY` is used on a self-hosted host when no row is stored.