EEK Uses No Static API Keys for Google Cloud — Authentication Is Cryptographic

No Keys to Steal

Static API keys in environment variables are the most common source of cloud service credential compromise. If the variable is accidentally logged, exposed in a build artefact, or accessed through a misconfigured endpoint, the key is compromised. EEK eliminated this risk for its Google Cloud integrations by migrating to Workload Identity Federation.

Authentication to Google Cloud APIs — including the Maps and Cloud Monitoring APIs used by EEK — is now handled via Vercel's OIDC token. For each request, Vercel provides a cryptographically signed token that proves the request is coming from EEK's legitimate deployment. Google Cloud validates this token in real time. There is no persistent key to store, rotate, or accidentally expose.

What This Protects

The Google Maps API is used for coverage queries, geocoding, and address validation. The Cloud Monitoring API is used for billing sync on API usage. Both integrations handle real data in live customer workflows. Securing them through cryptographic identity rather than static keys removes a class of risk that has caused high-profile credential breaches at other companies.