Repository: bokeh/bokeh

Issue:
Describe Google API key usage and embedding
Bokeh Gmaps in stores explicitly Google Maps API Key inside the cell of the Jupyter Notebook. 

When publishing the notebook, got warning email from google and thus needed to regenerate API key. 

See: 
https://raw.githubusercontent.com/vitekzkytek/PythonDataIES/31808eeb9eb32eff64a677fe7610684dc7e2b719/09/09_IntroToGeoData.ipynb and search for: "AIzaSyA1PafVW-WeNmBrbJvo3E4DTG6lfRlhGWU" (the key is already invalidated). 

the code in the cell does not reveal the key:
`map_options = GMapOptions(lat=50.08, lng=14.43, map_type="roadmap", zoom=14)`

`p = gmap(GOOGLE_MAPS_API_KEY, map_options, title="Pubs in Prague")`

Not sure if there is a way how not to save the key in the JSON object, but maybe at least warning that gmap stores API key could be useful


Discussion:
There's not really any alternative that I know of. Every static page anywhere that wants to display a Google Map in it anywhere will have to embed the key in the plain HTML text out of necessity. I'm not opposed to highlighting this in a prominent way in the docs, though. 
I surfed the internet and could not really find a way to not store the API key in the database while displaying the maps. Though a alert message in the documentation (as suggested above) seems a nice way to avoid confusion.
@bryevdv Could you suggest me with some very basics of how I can get started.
@ayushiitr2901 You could start by adding notes to the docstrings of `gmap` and `GMapPlot`. If you want to include a note in the narrative documentation, the relevant file is here:

https://github.com/bokeh/bokeh/blob/master/sphinx/source/docs/user_guide/geo.rst

We use Sphinx for our docs, which is the most common and standard tool for documenting Python projects. There are many howtos and tutorials about Sphinx online. To build our Sphinx docs does require a dev setup. you can find information about that (and some about building docs, tho possibly out of date) in the developer's guide:

https://docs.bokeh.org/en/latest/docs/dev_guide.html
I guess I should add, this is not quite correct:

>  will have to embed the key in the plain HTML text

We could perform some trivial obfuscation on the key (e.g. base64 encode it) and then send that to BokehJS, then BokehJS could decode that (in memory) before configuring the Google Maps API. That seems of marginal utility as it is only the slightest of deterrents to anyone dedicated. I would not consider it a priority, but I would not turn down a PR if anyone wanted to make one, either. 
 
@bryevdv Thank you for your help. I currently do not have much experience with using Sphinx, but I would love to learn more about it. I shall first analyze our code in my local setup and know about how it uses Sphinx and then I will proceed to solve the suggested issue.

Resolving patch:
diff --git a/bokeh/models/map_plots.py b/bokeh/models/map_plots.py
--- a/bokeh/models/map_plots.py
+++ b/bokeh/models/map_plots.py
@@ -129,6 +129,10 @@ class GMapPlot(MapPlot):
     e.g. ``(37.123, -122.404)``. It will be automatically converted into the
     web mercator projection to display properly over google maps tiles.
 
+    The ``api_key`` property must be configured with a Google API Key in order
+    for ``GMapPlot`` to function. The key will be stored in the Bokeh Document
+    JSON.
+
     Note that Google Maps exert explicit control over aspect ratios at all
     times, which imposes some limitations on ``GMapPlot``:
 
diff --git a/bokeh/plotting/gmap.py b/bokeh/plotting/gmap.py
--- a/bokeh/plotting/gmap.py
+++ b/bokeh/plotting/gmap.py
@@ -216,6 +216,8 @@ def gmap(google_api_key, map_options, **kwargs):
 
             https://developers.google.com/maps/documentation/javascript/get-api-key
 
+            The Google API key will be stored in the Bokeh Document JSON.
+
         map_options: (GMapOptions)
             Configuration specific to a Google Map
 


Test patch: