This is a client JS API key. If you want to spoof the referer you have to hack into all users of the web page and change the referer header their browser sends. And for what? Makes no sense.