I had to write a component which had a JS Client library which made some calls to the Google map API and some calls to other Google services like geocoding and timezone. I finally thought I got everything working and it worked perfectly on the Author instance when I "Viewed as Published". I have a valid Google Key. This is the jquery "map" call that works and the request/response shows up on the Network Pane of my Web Console.
The Author and Publish instances are on the AEM Cloud. I ssh'd into the Publish instance and was able to successfully "curl" the above maps.googleapis.com API call so it doesn't seem to be a firewall issue.
Any thoughts ? I put the client library "with" its component in /apps and included the call to the Clientlib CSS at the start of the component HTL file and the call to the JS at the end. This seems to be the current recommended way but I didn't see any other components done that way in the legacy code so maybe I've missed something here.
I have read that "Publish" server is more "locked down" that the Author instance so maybe there is some URL blocking or whitelisting or something like that that I don't know anything about.