API keys and secrets in the APK

Security Junior Kotlin 2.0+ API 24+ Reviewed By Best Latest Apps

Pick the fix

A team puts a payment provider's secret key in local.properties and reads it through BuildConfig. Is it safe?

Options
Hint 1 of 1

Where does BuildConfig end up?

Choose an answer, then open Show answer below to check it.

Show answer

Answer: A No. It ships in the APK; move the call to your backend

Correct. local.properties only keeps it out of git.

Why not the others?
  • B Yes, because local.properties isn't committed. The value is still compiled into the app.
  • C Yes, if R8 is enabled. R8 doesn't encrypt strings.
  • D Yes, if the key is split into parts. Parts are easy to reassemble.

30-second answer

No. Anything shipped in the APK, including BuildConfig fields, resources, native libraries and obfuscated strings, can be extracted. Keep real secrets on your server and have the app call your backend, which calls the third party. For keys that must ship, such as maps keys, restrict them by package name and signing certificate and set quotas.

Practise saying it · 25 s. No recording, just a timer

Explain API keys in apps.

Say your answer out loud, then check which of these points you covered:

  • Anything in the APK is readable
  • Backend proxy
  • Restrict shipped keys
  • Gradle plugin only protects git

Deep dive

The Secrets Gradle Plugin keeps keys out of version control, not out of the APK.

R8 obfuscation slows reading code; it doesn't hide strings.

Play Integrity can help a server check requests come from your genuine app.

Rotate keys you believe leaked.

Common mistakes

  • Believing BuildConfig or NDK code hides secrets.
  • Shipping a payment or admin key in the app.
  • Unrestricted keys with no quotas.

Senior take & follow-ups

Say 'no' clearly, then the backend proxy and key restrictions.

Follow-up questions

Think of your answer first, then open the hint.

  1. What does the Secrets Gradle Plugin protect?

    Show hint

    It stops keys being committed to git.

  2. How do you restrict a Google API key?

    Show hint

    By Android package name plus SHA-1 certificate fingerprint.

Compare on iOS: Protecting API keys Same answer on iOS: the binary isn't a safe place for secrets.

Related questions

Free tool

Keystore and APK fingerprint

Free tool: read the SHA-1 and SHA-256 fingerprints from a .jks, .p12, APK or certificate, for API key restrictions and signing setups.

Open the tool

Suggest a fix if something here is wrong or out of date.