AIza Audit

aizaudit checks which Google APIs accept a supplied API key. It reports whether the key was accepted, which services responded, and which API or application restrictions were visible from the machine running the scan.

It does not search for leaked keys or read a key's Google Cloud configuration.

Download the latest release

Only test keys and projects you own or have permission to assess. Never post keys or unredacted reports in issues.

Download

The release binaries are self-contained; .NET is not required.

Platform	Download
Windows x64	aizaudit-win-x64.exe
Linux x64	aizaudit-linux-x64
SHA-256	SHA256SUMS.txt

Rename the downloaded binary to aizaudit (aizaudit.exe on Windows). On Linux, also run chmod +x aizaudit.

Usage

Prompt for a key without putting it in shell history:

Read-Host "Google API key" | .\aizaudit.exe

read -rsp "Google API key: " key; printf '\n'
printf '%s\n' "$key" | ./aizaudit
unset key

Common examples:

# Read several keys from a file
.\aizaudit.exe --key-file keys.txt

# Write JSON
$env:GOOGLE_API_KEY = Read-Host "Google API key"
.\aizaudit.exe --from-env --json > report.json

# Show only accessible results
.\aizaudit.exe --key-file keys.txt --only-accessible

# Include disabled APIs in the report
.\aizaudit.exe --key-file keys.txt --verbose

# Test a browser context
Read-Host "Google API key" | .\aizaudit.exe `
  --referer https://example.com/app --origin https://example.com

Potentially billable probes are disabled by default. Enable them with --include-billable. APIs restricted to non-commercial use require the separate --include-noncommercial flag. Every report states how many probes ran and how many were skipped by these safeguards.

Run .\aizaudit.exe --help (Windows) or ./aizaudit --help (Linux) for all input options, exit codes, and defaults.

Firebase access audit

The access audit compares the same read without credentials and as a Firebase application user. Results are grouped as PUBLIC, AUTH ONLY, NO ACCESS, or INCONCLUSIVE.

It requires the explicit --firebase-access-audit opt-in. By default, AIza Audit creates a random email/password user, runs read-only checks, then deletes the user:

$env:GOOGLE_API_KEY = Read-Host "Google API key"
.\aizaudit.exe --from-env --firebase-access-audit

Use --firebase-temp-email EMAIL to create the temporary user with an exact email address. The tool does not modify or add a suffix to the supplied value.

The tool discovers the Firebase project ID, Realtime Database URL, and Storage bucket from public Firebase configuration where possible. It falls back to the documented default database locations and bucket names. The database root is read directly and Storage checks list metadata only; files are not downloaded.

Firestore cannot be safely discovered from an application-user token, so provide a known collection or document path:

.\aizaudit.exe --from-env --firebase-access-audit `
  --firebase-firestore-path 'users/{uid}' `
  --firebase-rtdb-path 'users/{uid}'

{uid} and {email} are replaced with the user's values. Realtime Database and Firestore responses are kept as raw JSON. List responses are limited to 20 records and every response to 64 KiB by default; use --firebase-max-records and --firebase-max-bytes to change those limits. Oversized automatic root reads fall back to a shallow key list.

Use --firebase-auth to test an existing user. The protected file can contain email/password credentials:

{
  "email": "tester@example.com",
  "password": "replace-me"
}

.\aizaudit.exe --from-env --firebase-access-audit `
  --firebase-auth firebase-user.json `
  --firebase-firestore-path 'users/{uid}'

It can instead contain {"idToken":"..."} or a plain ID token. Custom database URLs, Storage buckets, project IDs, and Firestore database IDs remain available as overrides; see --help.

Temporary-user deletion is attempted even when a check fails or the scan is cancelled. If deletion fails, the report includes the generated email and password so the account can be reused or removed manually. Treat those reports as credentials. If authentication fails, known targets are still checked anonymously. Account creation, database reads, and Storage listings can invoke project hooks or incur usage charges.

Results

Each probe reports one of these states:

ACCESSIBLE, KEY_RESTRICTED, REQUEST_CONTEXT_REQUIRED, API_NOT_ENABLED, BILLING_NOT_ENABLED, PROJECT_UNAVAILABLE, RATE_LIMITED, INVALID_KEY, NETWORK_ERROR, or UNKNOWN.

Accessible results explain what the key can reach and any safety measure used by the probe, such as avoiding account creation, email delivery, or access to real data.

Disabled APIs are omitted by default because they do not expose a usable capability. Use --verbose to include API_NOT_ENABLED results. --only-accessible continues to hide all non-accessible results.

When Google explicitly rejects the API key itself, the remaining probes are stopped and the report contains one INVALID_KEY result.

The overall key result is VALID, INVALID, or INDETERMINATE. Restriction ratings are STRONG, MODERATE, UNVERIFIED, or N/A.

Results describe only the IP, referrer, origin, and application context used for that scan. They do not show the key's full configuration or prove that an unobserved restriction is absent.

Use --json for schema-v3 output. JSON reports include interpretations, coverage, and raw response details for diagnostics. Keys are masked unless --show-key is set, but the report may still contain sensitive project or restriction details.

Probe safety

The catalog contains small, non-destructive requests across Google Maps Platform, YouTube, the Gemini API, Firebase Auth, public Workspace endpoints, and other Google services. Probes use nonexistent resources or reserved .invalid addresses where needed and avoid operations that create or change data.

The opt-in Firebase access audit is the exception: it can create and then delete a temporary Auth user. Its data-service checks remain read-only and bounded.

Pricing and terms can change. Check the relevant Google documentation before enabling billable or non-commercial probes. APIs that require OAuth or a service account are not tested.

Build

The project uses .NET 10.

dotnet restore AIzaAudit.slnx
dotnet build AIzaAudit.slnx -c Release --no-restore
dotnet test AIzaAudit.slnx -c Release --no-build
dotnet format AIzaAudit.slnx --verify-no-changes --no-restore

Run from source:

Read-Host "Google API key" |
  dotnet run --project AIzaAudit --no-launch-profile --

Building Native AOT on Windows requires Visual Studio 2022 or Build Tools with the Desktop development with C++ workload.

Contributing and security

See CONTRIBUTING.md before changing a probe. Report security issues as described in SECURITY.md.

License

Apache License 2.0

Disclaimer

AIza Audit is not affiliated with or endorsed by Google LLC. Google and its product names are trademarks of Google LLC.