For the Google Maps Javascript API v3 the keys must be public on you page.
The applicable text is:
Restrict your API keys to be used by only the IP addresses, referrer URLs, and mobile apps that need them
Go to the Google API Console and generate a key, restricting it to URLs that you own (or want to put maps on) to prevent quota “theft”.