I have a project which I use Google Places API. For the API key I have now, I have set IP restriction because the API is called in server-side. Place Search and Place Details are called in Server and returned to client side.
But the endpoint Place Photos, I call in client side, and of course it doesn't work because I have set IP restriction. So, my idea is to create one more production api key which works on client side and set HTTP referrers. Is this Ok? Or should I call all apis in server-side instead?