AWS S3 Backup: Complete Setup Guide (2026)
.webp)
TL;DR
AWS S3 backup means three different things: versioning (undo for a bucket), AWS Backup (scheduled point-in-time backups), and cross-region replication (disaster recovery). Always enable versioning first, add a lifecycle policy to control cost, then layer AWS Backup or replication based on how critical your data is. Full console and CLI steps below.
AWS S3 backup can mean three different things, and picking the wrong one is why so many backup setups quietly fail. This guide walks through all three methods, when to use each, and the exact steps to set them up, so your data is actually protected, not just assumed to be.
Here is the short version before the detail. S3 versioning protects against accidental overwrites and deletes inside one bucket. AWS Backup gives you scheduled, centralized, point-in-time backups you can restore from. Cross-region replication copies your data to another region for disaster recovery. Most solid setups use versioning as the foundation, then add AWS Backup or replication on top. This guide sets up all three.
A quick note before you start: run every command in this guide against a test bucket first, never a production bucket, until you are confident in the result.
The three ways to back up S3, and when to use each
Most confusion around S3 backup comes from treating these as one thing. They are not. Here is what each does.
S3 versioning keeps every version of an object. Overwrite a file, and the old version is still there. Delete one, and it is recoverable. Think of it as an undo button for a single bucket. It is the foundation of almost every backup strategy, and it is required for the other methods.
AWS Backup is a managed service that takes scheduled, point-in-time backups of your bucket and stores them in a backup vault you can restore from. It is the closest thing to traditional, centralized backup, with policies, retention, and cross-account support.
Cross-region replication automatically copies objects to a bucket in another AWS region. If an entire region has an outage, your data still exists elsewhere. This is disaster recovery, not day-to-day backup.
The honest rule: enable versioning first, always. Then add AWS Backup for scheduled restore points, and cross-region replication if you need disaster recovery. Now let us set each one up.
Before you start: prerequisites
Get these in place first. A missing prerequisite is the most common reason a backup setup fails silently.
An AWS account with billing enabled and an S3 bucket you can test on. Do not run your first attempt against production.
An IAM user or role with S3 read and write permissions on the target bucket, including permission to manage versioning and lifecycle configuration.
AWS CLI v2, the latest version, configured with your credentials using the aws configure command.
A rough idea of your retention needs: how many versions you want to keep, and for how long.
Method 1: Enable S3 versioning (the foundation)
Versioning is where every backup strategy starts. When enabled, S3 keeps every version of an object, so an accidental overwrite or delete is always recoverable.
Using the AWS Console
Sign in to the AWS Management Console and open the S3 service. In the navigation pane, click Buckets, then select the bucket you want to protect. Open the Properties tab, find Bucket Versioning, click Edit, choose Enable, and save. Versioning is now on for that bucket.
Using the AWS CLI
To enable versioning from the command line, run this, replacing the bucket name with your own:
aws s3api put-bucket-versioning --bucket your-bucket-name --versioning-configuration Status=Enabled
To confirm versioning is active:
aws s3api get-bucket-versioning --bucket your-bucket-name
One important caveat: versioning keeps every version forever unless you tell it not to. Without a cleanup rule, your storage costs grow indefinitely. That is what the next step fixes.
Method 2: Add a lifecycle policy to control cost
Versioning alone will pile up old versions and inflate your bill. A lifecycle policy automatically manages those old versions, moving them to cheaper storage or deleting them after a set time.
A common, sensible rule: keep noncurrent (older) versions for 30 days, then delete them. That gives you a month to recover a mistake without paying to store every version forever.
Create a file named lifecycle-policy.json with your rule, then apply it:
aws s3api put-bucket-lifecycle-configuration --bucket your-bucket-name --lifecycle-configuration file://lifecycle-policy.json
Adding a lifecycle rule to a versioned bucket is an AWS best practice. It prevents old versions from accumulating, which both controls cost and keeps request performance fast.
Method 3: Set up AWS Backup for scheduled, restorable backups
Versioning protects within a bucket. AWS Backup gives you true, centralized, point-in-time backups you can restore from a vault, the closest thing to traditional backup software.
Two requirements before you begin. First, versioning must be enabled on the bucket; AWS Backup requires it. Second, the role you use needs the AWS managed policies for S3 backup and restore attached.
The setup, step by step
Open the AWS Backup console. Create a backup vault, which is the secure store for your backups. Create a backup plan, where you set the schedule (for example, daily) and how long to keep each backup. Assign your S3 bucket to the plan using its resource ID or a tag. AWS Backup now takes backups automatically on your schedule.
To restore, you pick a recovery point from the list, which represents your bucket's state at that moment, and restore the whole bucket or specific prefixes to the original bucket, another bucket, or a new one in the same region.
One cost note: AWS Backup stores all versions present when the backup runs, including objects scheduled for deletion. Setting a lifecycle expiration on your versions, as in Method 2, keeps those backup costs down.
Method 4 (optional): Cross-region replication for disaster recovery
If you need protection against an entire region failing, replicate to another region. This is disaster recovery, and it is optional for most teams but essential for critical data.
Both the source and destination buckets must have versioning enabled. Create the destination bucket in a different region:
aws s3 mb s3://your-backup-bucket-dr --region us-west-2
Enable versioning on it:
aws s3api put-bucket-versioning --bucket your-backup-bucket-dr --region us-west-2 --versioning-configuration Status=Enabled
Then configure a replication rule on the source bucket (via the console's Management tab or the CLI) pointing to the destination. New objects will replicate automatically.
Which method should you actually use?
Here is the honest guidance for common situations.
For a small project or side app: enable versioning plus a lifecycle policy. That alone protects you from the most common disaster, accidental deletion, at almost no cost.
For a business application: versioning plus a lifecycle policy plus AWS Backup. You get accidental-delete protection and scheduled, restorable, point-in-time backups.
For critical or regulated data: all of it, versioning, lifecycle, AWS Backup, and cross-region replication, so you are covered against everything from a fat-fingered delete to a full region outage.
The mistake to avoid: assuming S3's famous durability means your data is backed up. S3 is extremely durable against hardware failure, but durability does not protect you from someone deleting the wrong thing or an app writing bad data. That is what backups are for, and why versioning should always be on.
Setting up cloud infrastructure the right way
A backup strategy is one piece of getting cloud infrastructure right. If you are building an application that needs reliable, secure, well-architected AWS setup, from storage to deployment, the Craxinno team builds and maintains production cloud infrastructure for clients worldwide.
See recent work in the Craxinno portfolio, view our full stack on the technologies page, or email sales@craxinno.com.
Frequently Asked Questions
How do I back up an S3 bucket?+
There are three methods. Enable S3 versioning to keep every version of an object and recover from accidental deletes. Use AWS Backup for scheduled, point-in-time backups you can restore from a vault. Use cross-region replication to copy data to another region for disaster recovery. Most setups start with versioning, add a lifecycle policy to control cost, then layer AWS Backup or replication as needed.
Is S3 versioning the same as a backup?+
Not quite. Versioning protects against accidental overwrites and deletes within a single bucket, acting like an undo button. It is the foundation of backup but not a complete strategy on its own. For scheduled, restorable, point-in-time backups, use AWS Backup. For protection against a full region outage, add cross-region replication. Versioning is required for both.
Does AWS Backup require S3 versioning?+
Yes. You must enable S3 versioning on your bucket before you can use AWS Backup for Amazon S3. The role you use also needs the AWS managed policies for S3 backup and restore attached. AWS recommends setting a lifecycle expiration on your versions, since AWS Backup stores all versions present when the backup runs, which affects cost.
How do I control S3 backup costs?+
Add a lifecycle policy to your versioned bucket. Without one, old versions accumulate forever and your storage bill grows indefinitely. A common rule keeps noncurrent versions for 30 days, then deletes them, or moves them to cheaper storage like S3 Glacier. This is an AWS best practice and also keeps request performance fast.
Is my S3 data already backed up because S3 is durable?+
No. S3 is extremely durable against hardware failure, but durability does not protect you from human error or application bugs. If someone deletes the wrong object or an app writes bad data, durability will not save you. That is exactly what backups are for, which is why enabling versioning should be your first step.
Building something with AI?
We ship production AI — agents, RAG pipelines and LLM integrations that survive real users, not demos.
Start a projectKeep ReadingMore case studies like this
Engineering retros, product launches, and brand systems from our studio — updated monthly.
All case studiesTechnology Used
.svg){kind=logo}
Node.js
AWSTags & Keywords
Continue with Blogs.
View all blogs
Software AgencyHow to Vet a Software Development Agency Before You Hire
How to Vet a Software Development Agency Before You Hire Vetting a software development agency before you hire comes down to one principle: judge them on evidence, not on the pitch. Any agency can build a polished website and a confident sales call. What separates the ones who deliver from the ones who disappoint is what they show you when you ask the right questions, real work, real references, a real process, and honest answers about how they handle problems. We are an agency, so we will be straight about the uncomfortable parts, including the questions that expose a weak agency and the red flags that should make you walk away, even from a team that pitches well. This guide gives you a practical vetting process: what to check before you talk, the questions that reveal the truth on a call, the warning signs, and how to test an agency cheaply before you commit real money. This is not about finding the biggest or cheapest agency. It is about finding the one that will actually ship what you need, on time, without drama. The quick answer: how to vet an agency If you want the process in one glance, here it is. Each part is detailed below. Check the evidence first: real portfolio work, live products you can use, and references you can actually call. Then ask the hard questions: how they run projects, who does the work, how they handle delays, and what happens when something breaks. Watch for red flags: vague answers, no clear process, only good news, and pressure to sign fast. Then test small: a paid trial task before a big commitment. Judge what they show you, not what they say. The agencies worth hiring make this easy, because they have real work and a real process to point to. The ones to avoid get vague exactly where it matters. Before you talk: what to check on your own Do this homework before the first call, and half the field eliminates itself. Look at real, live work, not just screenshots. A portfolio of pretty mockups proves nothing. Ask for links to products actually in use, and open them. Do they work well? Are they fast? Would you be happy if that were your product? Real, shipped software is the single strongest signal an agency can give. Check for depth in your kind of project. An agency that has built things like what you need, your platform, your industry, your complexity, carries hard-won knowledge a generalist does not. Look for evidence they have solved your specific kind of problem before. Read reviews on independent platforms. Look beyond the testimonials on their own site, which are curated. Check independent sources for patterns, especially in how they handle things going wrong, since every project hits bumps and the reviews reveal how an agency behaves when they do. Look at how they communicate before you hire. Their responsiveness, clarity, and professionalism during your first few emails is a preview of what working with them will feel like. Slow, vague, or careless now rarely improves later. The questions that reveal the truth on a call Once you are talking, these questions separate real agencies from good salespeople. Ask them directly and listen for specifics. "Can I see work similar to my project, and talk to that client?" A confident agency offers references freely. Hesitation here is a warning. Actually calling a reference is one of the most revealing things you can do, and most buyers skip it. "Who exactly will work on my project?" You want to know whether the senior people in the sales meeting are the ones who build, or whether the work is quietly handed to juniors. Ask who your team is and who leads delivery. "How do you run a project week to week?" Listen for a real process: regular demos, clear communication, and a way to track progress. A vague "we're agile" with no specifics often means no real process at all. This is exactly what good project management looks like , and its absence is a serious risk. "How do you handle delays and problems?" Every project has them. A strong agency describes a process for surfacing issues early and honestly. An agency that only talks about smooth successes is either inexperienced or not being straight with you. "How do you handle changes to scope?" Look for a clear, open process for new requests, so you are never surprised by an invoice or a silent delay. Vagueness here predicts budget pain later. "What does your testing and QA process look like?" An agency that treats quality as an afterthought ships buggy work. A serious one has a real approach to testing, because skipping QA costs far more than it saves . The red flags that should make you walk away Some signals mean stop, even if everything else looks good. The price is far below everyone else. A quote dramatically under the rest of the market is not a bargain; it usually signals inexperience, hidden costs, or corners about to be cut. The cheapest agency is rarely the cheapest outcome. They cannot show real, live work. If everything is "under NDA" or only exists as mockups, be skeptical. Legitimate agencies can almost always show something real. There is no clear process or point of contact. If you cannot get a straight answer on how projects run or who owns your delivery, expect chaos once the work starts. They only tell you what you want to hear. An agency that agrees with everything, promises everything, and raises no concerns is selling, not advising. The good ones push back and tell you hard truths before you hire, not after. They pressure you to sign quickly. Urgency and "this price is only good today" are sales tactics, not signs of a good partner. A confident agency lets the evidence speak and gives you time. Vague pricing and scope. If they will not put a clear scope and price in writing, that ambiguity will cost you later . Get specifics before money changes hands. Test small before you commit big Here is the single most effective way to vet an agency, and most buyers never do it. Start with a small, paid trial project before the large commitment. A well-scoped first task, a small feature, a prototype, a self-contained piece of the work, tells you more in two weeks than any number of sales calls. You see how they actually communicate, how they handle feedback, whether they hit their estimate, and whether the work is good. A confident agency welcomes this, because they know their work will earn the larger project. An agency that resists a paid trial, or insists you commit to everything up front, is telling you something. This staged approach removes almost all of your risk, and it is exactly how the best client-agency relationships tend to begin. How to make the final decision Once you have done the homework, asked the questions, and ideally run a trial, the decision gets simpler. Weigh evidence over impression. The agency that showed real work, gave real references, explained a real process, and delivered a solid trial is a safer bet than the one that merely pitched better. Charisma is not delivery. Weigh fit over size. The right agency for you is the one that fits your project, your stage, and your communication style, not necessarily the biggest name or the lowest price. A great fit at a fair price beats a famous logo that treats you as a small account. Trust how it felt to work with them. Your experience during vetting, the clarity, the honesty, the responsiveness, is the most reliable preview of the whole engagement. Believe it. Ready to work with an agency that earns it? Vetting well is worth the effort, because the cost of choosing wrong, a blown budget, a missed deadline, a product you have to rebuild, dwarfs the time it takes to check properly. Judge on evidence, ask the hard questions, watch for the red flags, and test small before you commit. The Craxinno team is happy to be vetted exactly this way, with real work to show, references to call, a clear process, and a paid trial task to prove the fit before you commit. See recent work in the Craxinno portfolio , view how we work on the work process page, or email sales@craxinno.com .
NginxNginx SSL Setup: Free HTTPS with Let's Encrypt
Nginx SSL Setup: Free HTTPS with Let's Encrypt Setting up SSL on Nginx with Let's Encrypt gives your site free HTTPS in about ten minutes, and it is far simpler than most people expect. You do not hand-edit certificates or wrestle with config files. A tool called Certbot does the hard parts for you: it gets the certificate, rewrites your Nginx config to use it, and even sets up the automatic HTTP-to-HTTPS redirect. This guide walks through the whole process, start to finish. Here is the one part you must not skip, and the part cheap tutorials gloss over. Let's Encrypt certificates expire every 90 days. If a certificate expires, your entire site goes offline for every visitor, showing a scary security warning. So the goal is not just to turn on HTTPS today; it is to set up automatic renewal so it stays on forever without you thinking about it. We will cover both. The quick answer: the whole process If you just want the path, here it is. Details for each step follow. Point your domain at your server and make sure Nginx is running. Install Certbot and its Nginx plugin. Run one Certbot command to get the certificate and configure HTTPS automatically. Choose to redirect all traffic to HTTPS. Test that automatic renewal works. That is it. The single Certbot command does most of the work. The renewal test at the end is what guarantees your site never goes down from an expired certificate. What Let's Encrypt and Certbot actually are Two quick definitions, because they do different jobs. Let's Encrypt is a free, automated certificate authority. A certificate authority is the trusted organization that issues the SSL/TLS certificates browsers rely on to show the padlock and enable HTTPS. Traditionally these cost money; Let's Encrypt provides them free, and its certificates are trusted by every major browser. Certbot is the tool that talks to Let's Encrypt for you. It proves you own your domain, downloads the certificate, installs it, edits your Nginx configuration to use it, and sets up renewal. In short: Let's Encrypt issues the free certificate, and Certbot does the work of getting and installing it. Together they turn what used to be a fiddly paid process into a few free commands. Prerequisites Get these in place first, or the process will fail at the domain-verification step. A server running Nginx on Linux (Ubuntu or Debian for this guide), which you can access over SSH with sudo privileges. A registered domain name whose DNS A record points to your server's public IP address. This is essential, Let's Encrypt verifies you control the domain by reaching it over the internet, so the domain must resolve to your server before you start. Ports 80 and 443 open on your server's firewall, since Let's Encrypt uses port 80 to verify ownership and port 443 serves the secure traffic. Step 1: Install Certbot and the Nginx plugin Connect to your server over SSH, then update your package list and install Certbot with its Nginx plugin: sudo apt update sudo apt install certbot python3-certbot-nginx -y Confirm it installed: certbot --version The python3-certbot-nginx plugin is the important part, it is what lets Certbot read and edit your Nginx configuration automatically, which is what makes this whole process easy. Step 2: Get your certificate and enable HTTPS This is the step that does almost everything. Run one command, replacing the domains with your own: sudo certbot --nginx -d yourdomain.com -d www.yourdomain.com Certbot will ask for an email address (for renewal reminders and urgent notices) and ask you to agree to the terms. Then, on its own, it verifies you own the domain, obtains the certificate from Let's Encrypt, edits your Nginx configuration to use it, and reloads Nginx. When it asks whether to redirect HTTP traffic to HTTPS, choose yes (the redirect option). This ensures visitors always land on the secure version of your site. That single command has now given you working HTTPS. Step 3: Confirm HTTPS is working Open your site in a browser using https:// and look for the padlock icon in the address bar. Click it, and you should see that the connection is secure and the certificate was issued by Let's Encrypt. For a thorough check, you can run your domain through a public SSL testing tool, which grades your configuration and flags any weaknesses. A clean result here means your certificate and Nginx settings are solid. Step 4: Set up automatic renewal (do not skip this) This is the step that keeps your site online for good. Let's Encrypt certificates last only 90 days, so they must be renewed regularly, and doing it by hand is a recipe for an eventual, avoidable outage. The good news: modern Certbot sets up automatic renewal for you during installation. It installs a scheduled task (a systemd timer) that quietly checks twice a day and renews any certificate close to expiry. You usually do not have to configure anything. What you must do is confirm it works. Run a renewal dry run, which simulates a renewal without actually doing one: sudo certbot renew --dry-run If it completes without errors, your automatic renewal is working, and your certificate will keep renewing itself indefinitely. This one test is the difference between "set and forget" and a surprise outage in three months. Step 5: Reload Nginx automatically after renewal One refinement worth adding. When a certificate renews, Nginx needs to reload to actually start serving the new one. Modern Certbot generally handles this, but you can make it explicit and reliable with a deploy hook, a small script Certbot runs automatically after every successful renewal, that reloads Nginx. Adding this guarantees the freshly renewed certificate is served immediately, with no manual step and no gap. Common problems, and how to fix them A few issues catch almost everyone. Here is how to clear them fast. "Challenge failed" or domain verification error. Your domain's DNS is not yet pointing to the server, or port 80 is blocked. Confirm your A record resolves to the server's IP and that the firewall allows port 80, then try again. The certificate works but the site still shows "not secure." Nginx may not have reloaded, or HTTP is not redirecting. Reload Nginx and confirm you chose the HTTPS redirect in Step 2. Renewal dry run fails. Something changed since setup, often the Nginx config or the domain's DNS. The error message points to the cause; fixing it now prevents a real expiry outage later. "Too many certificates already issued." Let's Encrypt limits how many certificates you can request for a domain in a short window. Wait for the window to reset rather than retrying repeatedly. Ready to ship a secure, production-ready site? Getting free HTTPS on Nginx with Let's Encrypt is genuinely quick, and with automatic renewal set up and tested, it stays secure without any ongoing effort. The padlock is not just for trust; it is required for modern SEO and for many browser features, so it is one of the highest-value ten-minute jobs you can do for a site. If you would rather have secure, well-configured hosting handled as part of a real product build, the Craxinno team sets up and maintains production infrastructure for clients regularly. See recent work in the Craxinno portfolio , view our full stack on the technologies page , or email sales@craxinno.com .
Google Places APIHow to Get a Google Places API Key (Step-by-Step)
How to Get a Google Places API Key (Step-by-Step) Getting a Google Places API key takes about five minutes, and this guide walks you through every step. But here is the part most tutorials rush past, and the part that actually matters: creating the key is easy, and restricting it is what saves you from a surprise bill. An unrestricted key that leaks can be used by anyone, and the charges land on you. So we will get your key first, then lock it down properly. One thing to know up front, because it catches everyone: Google requires you to enable billing and add a credit card, even if you only plan to use the free tier. The key itself is free to create, and Google will not charge you unless you exceed the generous free limits, but the card is mandatory. This guide covers the full setup, how to secure the key, and how to make sure you never pay more than you meant to. The quick answer: the six steps If you just want the path, here it is. Each step is detailed below. Create a Google Cloud project at the Google Cloud Console. Enable billing (a credit card is required, even for the free tier). Enable the Places API for your project. Create the API key under Credentials. Restrict the key immediately by app and by API. Set quotas and budget alerts so you never overspend. The whole thing takes a few minutes. The two steps people skip, restriction and quotas, are the two that protect your wallet, so do not skip them. What a Google Places API key actually is A quick definition, so the steps make sense. The Google Places API is a service that lets your website or app use Google's location data, searching for places, autocompleting addresses as a user types, and pulling details like a business's name, hours, or rating. An API key is a unique string of characters that identifies your project to Google every time your app makes one of these requests. It is both your pass to use the service and the way Google tracks your usage for billing. Think of the key like a membership card with your name on it. It lets you in, and everything you do is charged to your account. That is exactly why keeping it private and restricted matters so much, which we will cover after the setup. Step 1: Create a Google Cloud project Go to the Google Cloud Console at console.cloud.google.com and sign in with a normal Google account. At the top of the page, click the project dropdown, then New Project. Give it a clear name (something like "my-app-places") and click Create. If you are new to Google Cloud, you will also be offered a $300 free trial credit that lasts 90 days. This is separate from the Places API free tier and applies across Google Cloud, so it is a useful cushion while you get set up. Step 2: Enable billing This is the step that surprises people. Before you can use the Places API, you must enable billing on your project, which means adding a credit card, even if you intend to stay entirely within the free tier. In the console menu, go to Billing, then link or create a billing account and add your card. Google will not charge you unless your usage goes past the free monthly limits, but it will not let you use the API at all without a card on file. This is normal and required for everyone. Step 3: Enable the Places API Now turn on the specific service you need. In the console menu, go to APIs & Services, then Library. Search for "Places API," select it, and click Enable. Only enable the APIs you actually plan to use. Each one is billed separately, so enabling extras you do not need just widens the surface where costs, or mistakes, could appear. Step 4: Create your API key With the Places API enabled, go to APIs & Services, then Credentials. Click Create Credentials at the top, and choose API key. Google generates your key instantly and shows it in a dialog. Copy the key somewhere safe. This is the string your app will use to make requests. Do not paste it into public code, a public repository, or anywhere it can be seen, for reasons the next step makes clear. Step 5: Restrict your key (the step that protects you) This is the most important step in the whole guide, and the one most tutorials treat as optional. It is not optional. An unrestricted key is a key anyone can steal and use, running up charges billed to you. Restrict it in two ways. First, application restrictions: tell Google which websites, apps, or IP addresses are allowed to use this key, so a stolen key will not work from anywhere else. For a website, restrict it to your domain. Second, API restrictions: limit the key to only the Places API, so even if it leaks, it cannot be used for other, pricier Google services. On the key's settings page in Credentials, set both restrictions and save. A properly restricted key is nearly useless to anyone who steals it, which is exactly what you want. Step 6: Set quotas and budget alerts The final safety layer. Restriction stops misuse; quotas and alerts stop overspending. Set a quota limit on your Places API usage, ideally at or below the free monthly allowance, so requests simply stop once you hit your ceiling rather than rolling into paid usage. Quotas are the control that actually prevents charges. Then set a budget alert so Google emails you when spending approaches a limit you choose. Note the difference: a budget alert only warns you, while a quota actually caps usage. Use both, but rely on the quota to protect the bill. What the Google Places API costs in 2026 A quick, honest picture so there are no surprises. Google Places uses pay-as-you-go pricing, billed per SKU, meaning each type of request- a search, an autocomplete, a place-details lookup- has its own price. There is a free monthly allowance for each, and you only pay once you exceed it. As rough 2026 figures, a text search runs a few dollars per 1,000 requests, and a place-details call runs higher, in the range of several dollars to around $17 per 1,000 depending on how much data you request. One counterintuitive thing worth knowing: with autocomplete, an abandoned search where the user types and then leaves can sometimes cost more than a completed one, because each keystroke can trigger a billable request. This is exactly why the quotas in Step 6 matter. Always check Google's official pricing page for current, exact numbers before you launch, since these change. Common problems, and how to fix them A few issues catch almost everyone. Here is how to clear them fast. "This API key is not authorized." Your key restrictions are blocking the request. Check that your app's domain or IP is in the allowed list, and that the Places API is among the key's allowed APIs. "Billing not enabled." You skipped or did not finish Step 2. Add a valid credit card to the billing account, even for free-tier use. The key works locally but not in production. Your application restrictions likely allow your test environment but not your live domain. Add the production domain to the allowed list. Unexpected charges. Almost always an unrestricted key that leaked, or missing quotas. Restrict the key immediately and set a quota below the free allowance. Ready to build with Google's location data? Getting a Google Places API key is quick, but doing it safely- restricting the key and capping usage- is what separates a smooth launch from a surprise invoice. Follow the six steps above, and you get a working key that stays secure and stays within budget. If you would rather have the setup, integration, and cost controls handled properly as part of a real product build, the Craxinno team implements Google Maps and Places integrations for clients regularly. See recent work in the Craxinno portfolio , view our full stack on the technologies page , or email sales@craxinno.com .
© 2026 — Craxinno Technologies
