How to hide your API keys on Android

Developing Android apps using Google Maps Platform SDKs, but worried about the security of your API Keys? Learn one way to protect your API Keys by hiding them from version control with an open source plugin.

#Geocasts #Developer

[ZeroDevID]

**DISCLAIMER:** This plugin is primarily for hiding your keys from version control. Since your key is part of the static binary, your API keys are still recoverable by decompiling an APK. So, securing your key using other measures like adding restrictions (if possible) are recommended.

[dimitriskatikaridis]

Google should allow developers assert the api key on the runtime. With that way, using some custom encryption and/or NDK, the apikey will be way more secured.

[go_better]

Thanks! Very brief, useful and straight to the point!

[AlexSanchezMorales]

Just for clarification and as it's stated by the host in the intro. this is only to hide your key from source control. If you are trying to fix a Leaked GCP API Keys error from playstore console, you still got the error.

[AlexBGamesONLINE]

Does this keep people from being able to decompile the apk and view the api key?

[premdhanraj]

In this video you are giving one ID and in android documentation there is different ID and in your github repo there is another new ID. I tried all 3. For all 3 i got same error "plugin id not found". Can you give updated instruction in clear steps ?

[sukhwantsingh]

Will this api key be visible during the release apk decompile process?

[ronsivan]

Hi,
My app has been removed for this reason: Your app contains exposed Google Cloud Platform (GCP) API keys.
Which means my api key was exposed in my code.
I've applied the fix as described in the video with the latest version of the secrets-gradle-plugin.
Will this help to get my back on the Google Play Store?
Thanks

[Sonu.Singh.]

Personally I loved the Hindi Track 😍😍.

[erlangparasu]

we need more secure.. something like compiled as encrypted value, auto decrypt when accessing it

[BrandCatalogs]

If I use the plugin you typed, its working. But the one on the documentation isnt working. Why is that?

[AbhishekSingh-dqbj]

Does this process also helpful while saving any type of keys like API keys or AES keys?

[PhongTran-hzht]

Will it still work if I release the app?

[mhdunknown]

You could just skip this library and just put

Properties properties = new Properties()

buildConfigField "String", "API_KEY",

inside the defaultConfig{} block in the app module's build.gradle, and then call your API_KEY that's inside your local.properties with BuildConfig.API_KEY lol