I then upgraded my Bubble plan and moved the app to my own domain, and on my Google account I expanded the Client key’s application restrictions to allow interaction with the new domain:
Did you test it by setting the Key Restrictions to “None”?
Bubble’s Geocoding is done on the server side. The key you use on the server side can not have any restrictions because the request will not be coming from the url you whitelist in your Google Cloud Console.
The server API never had any restrictions. Changing the client API restrictions from ‘HTTP referrers’ to ‘none’ did the job (yay), but doesn’t that mean I’m leaving my users’ data in a vulnerable place? Is there another way to protect it?