I dove back into Google research after bugSWAT Mexico invited me in October 2025. My goal was to fuzz Google’s APIs at scale by tapping into their discovery documents—machine-readable specs that list endpoints, methods, and parameters. Public APIs like YouTube Data expose these docs openly, but internal ones (Internal People API, Cloud Marketplace) usually sit behind valid API keys. To collect keys, my colleague Michael and I scraped 61,200 Android APKs, unpacked them, and grepped for embedded keys. We built a Chrome extension to intercept network traffic across 2,800+ Google web domains, decrypted iOS IPAs, and combed through Google binaries. Then we used a trick: feeding each key to a protos.googleapis.com call to reveal its GCP project number, and passing that number into the Cloud Marketplace API to see if the project belonged to google.com (or acquisitions like nest.com). That let us filter out third-party keys. Next, we assembled a list of live Google API domains from our extension logs, brute-forced names, and certificate transparency entries. Hitting each domain’s root and checking for headers like “Server: ESF” or “GSE” confirmed they were active. With valid keys and domains in hand, we scanned for discovery docs. Google had removed the standard “/$discovery/rest” path in mid-2025, but by trying different workarounds and appending visibility labels (e.g. “?labels=GOOGLE_INTERNAL”), we exposed hidden endpoints. After testing every known label across all keys, we pulled discovery documents for over 1,500 APIs. Authorization proved trickier. API keys handle access, but many endpoints also demand account-level credentials. Bearer tokens clash with API keys unless the project matches precisely. The workaround is Google’s First-Party Authentication: sending session cookies plus an “Authorization: SAPISIDHASH …” header to clients6.google.com hosts. That fuses API key and user session in a single request—essential if you want to fuzz anything beyond purely public, key-only methods.