title: Restricting usage for an Android key for a Google API
body: <p>My question is about how to properly set the package name and SHA-1 certificate fingerprint in the Google Developers Console in order to restrict usage of my Android API key to my app.</p>
  
  <p>When I don't have anything set in the "Restrict usage to your Android apps" section, my requests to the Google Translate API work properly. The API responds normally with status code 200 and my expected result.</p>
  
  <p>But when I specify a package name and SHA-1 certificate fingerprint for my app using the Developers Console, I consistently get 403 Forbidden responses like the following:</p>
  
  <pre><code>HTTP/1.1 403 Forbidden
  Vary: Origin
  Vary: X-Origin
  Content-Type: application/json; charset=UTF-8
  Date: Sun, 29 Nov 2015 21:01:39 GMT
  Expires: Sun, 29 Nov 2015 21:01:39 GMT
  Cache-Control: private, max-age=0
  X-Content-Type-Options: nosniff
  X-Frame-Options: SAMEORIGIN
  X-XSS-Protection: 1; mode=block
  Server: GSE
  Alternate-Protocol: 443:quic,p=1
  Alt-Svc: quic=":443"; ma=604800; v="30,29,28,27,26,25"
  Content-Length: 729
  
  {
   "error": {
    "errors": [
     {
      "domain": "usageLimits",
      "reason": "ipRefererBlocked",
      "message": "There is a per-IP or per-Referer restriction configured on your API key and the request does not match these restrictions. Please use the Google Developers Console to update your API key configuration if request from this IP or referer should be allowed.",
      "extendedHelp": "https://console.developers.google.com"
     }
    ],
    "code": 403,
    "message": "There is a per-IP or per-Referer restriction configured on your API key and the request does not match these restrictions. Please use the Google Developers Console to update your API key configuration if request from this IP or referer should be allowed."
   }
  }
  </code></pre>
  
  <p>The request looks like the following. Notice that there's no referer header in the request:</p>
  
  <pre><code>GET https://www.googleapis.com/language/translate/v2?key=XXXXXXXXXXXXXXXXXXXXXXXX-XXXXXXXXXXXXXX&amp;source=en&amp;target=es&amp;q=test HTTP/1.1
  User-Agent: Dalvik/2.1.0 (Linux; U; Android 5.1.1; Nexus 6 Build/LVY48H)
  Host: www.googleapis.com
  Connection: Keep-Alive
  Accept-Encoding: gzip
  </code></pre>
  
  <p>I'm assuming that the error message indicates a package name or SHA-1 fingerprint problem, despite its message about a "per-IP or per-Referer restriction". While browser keys allow the setting of a per-referer restriction, I'm using an Android key with nowhere to set a per-IP or per-Referer restriction.</p>
  
  <p>I'm sure I have entered the package name correctly in the Google Developers Console. I'm reading the package name from the <code>package</code> attribute on the <code>manifest</code> tag in my Android manifest file.</p>
  
  <p>I'm also sure I have the SHA-1 fingerprint set correctly in the Google Developers Console. I'm reading this value from my keystore using the command <code>keytool -list -v -keystore /path/to/my/keystore</code>. I get the same value when I read it from the APK file using <code>keytool -list -printcert -jarfile myAppName.apk</code>. I'm installing that same APK file using adb.</p>
  
  <p>Here's what I see in the Developers Console:</p>
  
  <p><a href="https://i.stack.imgur.com/ahZE2.png" rel="noreferrer"><img src="https://i.stack.imgur.com/ahZE2.png" alt="console screenshot"></a></p>
  
  <p>I've tested this on multiple devices running stock Android. I get the error response on wifi and on the cell network, whether I'm proxying the traffic or not.</p>
  
  <p>When I remove the restriction from the Developers Console, the app works properly again.</p>
  
  <p>What am I doing wrong here?</p>
  
  <p>Note: <a href="https://stackoverflow.com/questions/32529017/android-google-api-translate">Several</a> <a href="https://stackoverflow.com/questions/31589308/how-does-google-verify-android-sha1-fingerprints-and-packages">similar</a> <a href="https://stackoverflow.com/questions/30655974/how-to-use-google-public-api-access-key-in-android-application">questions</a> <a href="https://stackoverflow.com/questions/32595910/google-cloud-storage-api-with-android-api-key-not-working-however-browser-api-k">have</a> <a href="https://stackoverflow.com/questions/28356313/youtube-api-could-not-search-com-google-api-client-googleapis-json-googlejson">been</a> <a href="https://stackoverflow.com/questions/28591012/youtube-api-permission-403-forbidden-error">asked</a> <a href="https://stackoverflow.com/questions/29374420/google-storage-api-forbidden-iprefererblocked-error">before</a>, <a href="https://stackoverflow.com/questions/28645992/youtube-client-on-android-having-a-java-lang-nullpointerexception">but</a> <a href="https://stackoverflow.com/questions/29246452/google-books-api-keep-getting-error-code-403-reason-iprefererblocked">with</a> <a href="https://stackoverflow.com/questions/21075625/error-403-with-google-translate-v2-api-access">no</a> <a href="https://stackoverflow.com/questions/31586345/usage-of-google-translate-api-in-android">adequate</a> <a href="https://stackoverflow.com/questions/30848617/api-key-youtube-request">answers</a>. I don't want to use a browser key or remove the restriction altogether. I want to get the usage restriction to work properly.</p>