Ask HN: We screwed up with the Google Maps API and now have a significant bill | Hacker News Reader

Ask HN: We screwed up with the Google Maps API and now have a significant bill

18 pointsgriffoa25 comments

We recently found that requests using our Google Maps API key was blocked by Google due to an unpaid bill, so we now owe Google $20.000.

What happened was that at some time around the end of 2019 the credit card expired and nobody noticed it. The API just kept on working for our services, so we assumed everything was fine and we were probably within the free tier. The card was added and account configured by someone not working on the project anymore.

Then recently the service just stopped working and after a bit of digging around, we found that the account had racked up a bill of $20.000 since the end of 2019. Slowly and steady each month. It was nice enough of Google to give us quite the credit period there, but as it turns out after inspecting the cost breakdown, someone else must have been using the key since a lot of the requests were to API endpoints totally unrelated to the services we provide.

We screwed up big time by having an unrestricted key configured. It was setup in 2017 way back when things were free, so I doubt anybody actually thought about abuse of the key at that time, but none the less, here we are having our key abused.

Do we even have a chance here? Did anyone get into a similar situation? I would be grateful for a little bit of advice about how to approach Google. I realize this is our fault, but at the same time, it seems we never got any payment reminders or notifications that we had bills overdue - at least we cannot find them anywhere.

Time to get a lawyer, pore through the terms of service, etc.

A broken / blocked key should not result in this happening. It's a failure of the software. You should also be able to get the IPs that your account was connecting from, and disavow those that are not yours.

Divest yourself from Google and don't pay the bill if there's any way out of it.

Google gas for your car next. Taxes and google fees, the two things you can't avoid.

I feel like I live in the opposite bubble where google pays me and I would never pay for a google service.

I'm sorry this happened to you. Many people were shocked at their map api bill following google making it a paid service. We certainly did and now we don't use them any more.

Can you please recommend a good alternative?

Mapbox is far cheaper, has a good free tier, and has the highest-res satellite imagery I could find.

Would it be interesting to explore using all services in a round-robin fashion and fully take advantage of all free tiers? Not sure if it's too much trouble for the possible benefits.

It could lead to an ... interesting user experience if different services had slightly different data

That's a good point.

But it’s certainly a concept worth exploring, if not for the sake of exploiting free tiers but maybe for maximum availability.

Mapkit is pretty good.

https://developer.apple.com/maps/web/

Leaflet + OpenStreetMaps

This is what we use now as well.

Self-plug: NetToolKit Geo (https://www.nettoolkit.com/geo/about) offers very affordable map tiles (both raster and vector) and geocoding (plus a simple autocomplete feature for within the US). You can also configure whether your account automatically replenishes credits if they fall below a certain threshold, so you can have better control of spend.

I've had unintentional usage for few hundreds dollars. After explaining the situation and setting API limits the bill was cancelled. Your situation seems a bit different. But maybe explaining the situation and asking for help first is the best option.

Initially, I was like $20 is not significant- then I realized it’s $20k. That’s a lot of overdue bills without service getting disabled.

I would negotiate for reduction based on the fact that you didn’t get any notifications.

I used to work on the Google Maps API.

I can help. How can i get in touch with you?

Wow, that sounds great. You can reach me at email mlr@mm.st

Someone should have been in touch to help you. Sounds like they can help.

Find out who used your key without permission and make them pay their share of the bill.

Why can’t the business pay the bill?

It's way cheap to just use the unofficial api with proxies and caching.

It's sad for you and I hope that you will find a way to manage this problem with Google...

However, I'm quite shocked when you write "when things were free, so I doubt anybody actually thought about abuse of the key at that time" It look like - for you - having something free mean having something you can use without any care! From my point of view, if someone give me something for nothing, I will thank and try to use it wisely... But maybe I didn't understand what you meant

He probably means that they didn't see much reason to carefully secure a key for a free service. After all, why would anyone steal a key for a completely free service?

I don’t treat the credentials for hacker news with the same level of care that I provide for my Bitcoin wallet.

Reply on news.ycombinator.com