dont worry about the site key even if somoene tries to abuse it he won't be able because its tied to ur domain , the thing that u should worry about is the private key thats where the verification of the token start if somoene got it he can simply send milions of verification to ur google api and then it would cost u