Google allows to restrict API keys, but you can only restrict to URLs (useful for showing maps) or IP-addresses (useful for geocoding with PHP). I tested the inputfield using API keys with one of the restrictions each and one with no restrictions. The (expected) result:
key restricted only to URL: Map in the inputfield works, geocoding with hitting enter (not clicking outside the field before) works
key restricted to IP: Map does not work, but server-side geocoding (with PHP on save) works
key with no restrictions (not recommended!): everything works
So I think, there should be two fields for the configuration in the module: one for a server-side key and one for a frontend key (also used fro the inputfiled map). Or do I get something wrong?
Something else I noticed: In InputfieldMapMarker.module on line 79 and in MarkupGoogleMap.module on line 161 I think the domain should be googleapis.com instead of google.com