The author details how they harvested thousands of Google API keys from APKs, web traffic, and discovery documents—filtering for Google-owned projects—to map out live and hidden API endpoints. They then leverage AI to auto-generate and run fuzz tests at scale, tackling first-party authentication and visibility labels to uncover undocumented functionality.

• Scraped 61,200 APKs plus web/iOS traffic to harvest Google API keys, then cross-checked each against the Cloud Marketplace API to confirm it belonged to a google.com-owned project, filtering out third-party noise.
• Bypassed Google's mid-2025 removal of the standard discovery doc path by brute-forcing visibility labels like "?labels=GOOGLE_INTERNAL," exposing over 1,500 hidden/internal API discovery documents.
• Cracked first-party authentication (session cookies + "Authorization: SAPISIDHASH" header to clients6.google.com) as the key workaround for fuzzing endpoints that require both an API key and a real user session.