Hah, got it. I use uMatrix, which spoofs the http referer header. Google apparently does not like that:

// API callback webgoogle({ "error": { "code": 403, "message": "Requests from referer https://www.googleapis.com/ are blocked.", "errors": [ { "message": "Requests from referer https://www.googleapis.com/ are blocked.", "domain": "global", "reason": "forbidden" } ], "status": "PERMISSION_DENIED", "details": [ { "@type": "type.googleapis.com/google.rpc.ErrorInfo", "reason": "API_KEY_HTTP_REFERRER_BLOCKED", "domain": "googleapis.com", "metadata": { "service": "customsearch.googleapis.com", "consumer": "projects/blabla" } } ] } } );