google chrome extension - Referer security when requesting a Simple API Access Key -

i'm working inside of google chrome extension. extensions not send out "referer" header when issuing requests, possible (potentially) modify behavior using chrome.webrequest.onbeforesendheaders.

i attempting communicate google's youtube v3 api. so, must provide api key. successful request server looks like:

$.ajax({     url: 'https://www.googleapis.com/youtube/v3/playlists?part=snippet&id=alyl4ky05133rtmhtulsaxkj_y6el9q0jh&key=aizasybwegndkdnwkgr2bckrzqxnww00ka7t2lk',     success: function (response) {         console.log("success", response);     },     error: function (error) {         console.log("error:", error);     } }); 

now, request works because have gone google api console , created simple api access browser key allowed referers set to:

referers: referer allowed

this seems security flaw me because ensure program allowed query api. however, google has been pretty clear don't care flaw because can request api key @ time.

that said, i'm left wondering if correct implementation. there area inside of google api console allows define "client id installed applications" associated specific google chrome extension.

once installed application client id configured able interact chrome.identity.getauthtoken

this generates valid oauth2 auth token given client interested in in terms of security. however, can't use oauth2 token fulfill google api requests. not acknowledge oauth2 token valid client id (why should it?) nor provide means of accepting oauth2 token.

so, i'm left hanging here. have 1 means of requesting relatively secure token, isn't usable in request. and, have alternative, incredibly insecure means of generating api key works right out of box.

has else experienced this? should done?