Android Question How safe is my API keys?

Michael2150 said:

So I followed the instructions in this post here and integrated google maps into my application. In that tutorial it says you should put your API key in the manifest editor like this.

B4X:

AddApplicationText(
<meta-data
  android:name="com.google.android.geo.API_KEY"
  android:value="xxxxxxxxxxxxxx"/>
)

But now my question is, how safe is that really? I can take the APK and drop it into Android Studio and then go through the AndroidManifest.xml file to easily find the key just there in the open. I was wondering why the key had to be in the manifest in the first place and what is good practices if I want to safely use other keys throughout my application?

Click to expand...

private Sub ShowMap
    
    Try
        
        Dim Intent1 As Intent
        Dim urlMap As String="https://www.google.com/maps/search/"
        Dim su As StringUtils
        Dim Address As String
            
        Address=Main.SelectedClientAddress
        Address=Address.Replace(CRLF," ")       
        Address=su.EncodeUrl(Address,"UTF-8")           
        urlMap=urlMap & Address
                
        Intent1.Initialize(Intent1.ACTION_VIEW,urlMap)
        Intent1.SetComponent("googlemaps")
        StartActivity(Intent1)
    Catch
        Log("ShowMap " & LastException)
        modFun.ShowError("ShowMap " & LastException)
    End Try
    
End Sub

Alex_197 said:

If you worry about your keys - try the intent (you don't keys in this case)

Google Map:

private Sub ShowMap
   
    Try
       
        Dim Intent1 As Intent
        Dim urlMap As String="https://www.google.com/maps/search/"
        Dim su As StringUtils
        Dim Address As String
           
        Address=Main.SelectedClientAddress
        Address=Address.Replace(CRLF," ")      
        Address=su.EncodeUrl(Address,"UTF-8")          
        urlMap=urlMap & Address
               
        Intent1.Initialize(Intent1.ACTION_VIEW,urlMap)
        Intent1.SetComponent("googlemaps")
        StartActivity(Intent1)
    Catch
        Log("ShowMap " & LastException)
        modFun.ShowError("ShowMap " & LastException)
    End Try
   
End Sub

Click to expand...

Syd Wright said:

by first encrypting your API

Click to expand...

Michael2150 said:

That is an interesting solution I was also thinking about, and I will definitely keep it in mind when using some other more important keys with payments on them in the future.

Click to expand...

Syd Wright said:

or even make believe that it is a jpg or mp3 file (eg: "welcome.jpg" or "pling1.mp3")

Click to expand...

Michael2150 said:

But I do find it interesting to see all these other cool solutions to the problem.

Click to expand...

Syd Wright said:

Michael2150 wants to hide his APIkey such that others can't use it, which is very understandable.

Click to expand...