It depends on your application's functionality. Generally, you could keep all everything on the client-side. If you app is a server-rendered one, meaning you would be using a JavaScript framework like React or Vue, you could use just the website state to keep track of users' variables and send out requests to the Google APIs to do the heavy work.

You could also look into tools like Firebase, also created by the folks at Google to handle storage or user authentication. There are rich docs on how to include Firebase in your web application for your framework of choice. This way you can create language-agnostic backend resources that conform to all of the security measures and scales automatically so you can focus on the users' experience.

In case you would like to offer some less-common functionality or have complete control over the backend you could write up an API of your own and have it deployed on a separate backend server.