what are other options for avoiding to expose google api key

Question

When creating chrome extensions that play with the youtube data api, the api key is used. But is there any other way to get data from google servers instead of exposing our personal api key in the xmlhttprequest, apart from the naive way of asking the user to create his/her own api in their account and input that to use it in the extension?

Answer 1

I would refer to Google for best practices.

https://support.google.com/cloud/answer/6310037?hl=en

Answer 2

You could use OAuth 2.0 credentials, obtain an access token through chrome.identity API, and then use that token in the XMLHttpRequests.