I am currently working on a project which uses Blogger API from Google. Day before yesterday (saturday) someone attacked my application and grab the API Key, My daily limit for accessing posts is 100,000 (100K/24 hrs). I hit limit on Saturday (I suspect that those were fraudulent clicks made using my API key, since I've only around 4K customers using the application, I embedded the API key in client side code).
After that, In five minutes API limit reached again (after 24 hrs) 5K. So I deleted the API key and generated a new one.
My question is how can I secure my new API Key in client code, so that no attacker can gain access to API key or at least some method to indirectly use the API Key in Client Code.
The Google API console lets you bind your API key to a set of signing certificates of the app.
If you limit the API key to a few certificates, the API should be useless to an attacker. (As long as you keep your private key secret.)