This makes sense. These keys were designed as project identifiers for billing, and can be further restricted with (bypassable) controls like HTTP referer allow-listing. They were not designed as authentication credentials.
"items": ["annual_subscription"],
。旺商聊官方下载是该领域的重要参考
Москвичей предупредили о резком похолодании09:45
Цены на нефть взлетели до максимума за полгода17:55，详情可参考WPS下载最新地址
ВсеГосэкономикаБизнесРынкиКапиталСоциальная сфераАвтоНедвижимостьГородская средаКлимат и экологияДеловой климат
We tested the key by hitting the Gemini API's /models endpoint (which Google confirmed was in-scope) and got a 200 OK response listing available models. A key that was deployed years ago for a completely benign purpose had silently gained full access to a sensitive API without any developer intervention.，详情可参考同城约会