The Challenge
A compromised Google API key was used to generate approximately 100 million API requests, resulting in a significant unexpected billing amount. Strong API security depends on controlling who can use a key and how often, and this incident exposed gaps in both. The team had to escalate the charges to Google Support, trace the unusual request activity and understand how the key had been abused. A code review also surfaced duplicate API requests inside the application, while API credentials, email services and web applications all needed tighter access restrictions. Weak API security in one place had become a financial and operational risk across the wider infrastructure.
The Approach
Rather than fix a single key, Intellinez used the incident to strengthen API security end to end. The work followed six steps: investigate, identify, secure, optimize, harden and review. The unexpected usage was escalated to Google Support and the available evidence reviewed. The API key configuration and request-handling logic were then assessed, the affected credentials were rotated and restricted, and the application code was optimized to stop wasteful calls. Finally, the same API security mindset was applied to email delivery and web traffic through SendGrid and Cloudflare, so that a similar incident becomes far less likely.
Implementing API Security and Configuration Hardening
The hardening covered four layers, each closing a different route by which an exposed credential or inefficient code can turn into unwanted usage.
Investigating the Incident With Google Support
The team raised a support request with Google to investigate the compromised key and the unexpected charges, then worked through the traces available to understand the request activity. Google’s guidance shaped every later step, which made the investigation the foundation of the API security fixes that followed.
Rotating and Restricting the Google API Key
The affected credentials were rotated and the key configuration was hardened in line with Google’s guidance on securely using API keys. Limiting a key to the APIs and sources it genuinely needs is a core API security control, and stronger key-management practices now apply to credentials across the stack.
Removing Duplicate API Requests From Application Code
Engineers traced the code paths that generate API requests, then removed duplicate and unnecessary calls and tightened the request-handling logic. Efficient code is part of API security too: every redundant request adds cost, and during a billing incident it also makes abnormal traffic harder to spot.
Restricting SendGrid Access With IP Restrictions
Email delivery received the same treatment. IP restrictions limited SendGrid access to authorized sources, reducing the risk of unauthorized use of the email service. This follows SendGrid’s own IP access management controls and extends API security to every third-party service the applications depend on.
Hardening Web Traffic With Cloudflare WAF Rules
Cloudflare web application firewall rules and traffic-filtering controls were implemented and refined to mitigate suspicious requests, automated bots and unwanted traffic. Each rule was reviewed to balance protection with legitimate application behavior, bringing API security to the edge of the network. Cloudflare’s WAF documentation describes the rule model in detail.
The Results
The initiative strengthened API security across application integrations and the supporting infrastructure. The incident involving roughly 100 million requests was investigated with Google Support, the affected credentials were rotated and restricted, and duplicate requests were removed from the application. SendGrid access is now limited to authorized sources, and Cloudflare WAF rules and traffic controls manage suspicious requests more effectively. The same configuration-hardening approach now spans API integrations, email services, applications and web infrastructure, giving Intellinez a layered API security baseline. Related infrastructure work includes our Windows and Linux OS upgrade and PHP and WordPress upgrade case studies, and our web applications services, or browse all infrastructure and engineering projects.
