Disguise your API Keys in Android. Everyone has a secret | by tomerpacific | Jan, 2023 | Pirate Tech

You might be utilizing a model management system and your undertaking makes use of some providers that require API keys. That is all nicely and good if you’re in your native machine, however you clearly do not need to share these API keys with the world.

How can we hold our API keys inside our app, but in addition disguise them after we push our code to our repository?

We wish to have the ability to proceed to make use of our API keys as regular inside our functions, but in addition not expose them.

That is the place mysteries enters. Just like those you retain only for your self, however in a developer approach.

Secrets and techniques can signify essential info that your app requires to operate, however they should not be seen to anybody working exterior of the undertaking. These could be API keys or authorization tokens, however in essence it’s any authorization info that ought to solely be utilized by you and solely you. Just like how you do not need to share your web site password with anybody else.

🚨 Disclaimer: Please be aware that the answer supplied on this article works to not expose your secrets and techniques out of your model management system, however since they’re a part of your utility, they’ll nonetheless be found by decompiling your APK. To learn the way to do it, right here is an effective place to begin.

Protecting your secrets and techniques protected

1. In your undertaking, you must have a native.properties file within the root listing of your undertaking
2. To ensure your model management system ignores it, open the .gitignore file and see what’s there:

3. You will have to import the Secrets and techniques Gradle plugin into your undertaking:

3.1. Go to the foundation construct.gradle file of your undertaking and paste the next line:

 buildscript 
dependencies 
id 'com.google.android.libraries.mapsplatform.secrets-gradle-plugin' model '2.0.1' apply false

3.2. Go to your utility’s construct.gradle file and paste the next line:

plugins 
...
id 'com.google.android.libraries.mapsplatform.secrets-gradle-plugin'

4. Add your API key contained in the native.properties file:

5. You should utilize your secret inside your AndroidManifest.xml file by including a metadata tag inside your app tag:

 <utility
android:allowBackup="true" 
.....
>
<exercise>
....
</exercise>
<meta-data
android:title="YOUR_API_KEY_NAME"     /// Select any worth right here
android:worth="$API_KEY_NAME"/>    /// Write the title you gave inside your native.properties file
</utility>

6. To entry your API key, you should utilize the PackageManager to get the metadata:

val applicationInfo: ApplicationInfo = utility.packageManager
.getApplicationInfo(utility.packageName, PackageManager.GET_META_DATA)
val apiKey = applicationInfo.metaData["YOUR_API_KEY_NAME"]

7. Alternatively, you can even use the BuildConfig object to get it:

BuildConfig.YOUR_API_KEY_NAME