Secure API Keys and Secrets in Android Apps

An APK is a zip file. Its strings, BuildConfig constants, resources and even native libraries can be extracted with free tools in minutes. Obfuscation and NDK tricks slow attackers slightly, and runtime interception defeats them anyway. Design as if every key in the app is public.

Classify your keys

Keeping keys out of source control

Even for keys that are allowed in the app, avoid committing them to Git, where they're scraped quickly from public repos. The Secrets Gradle Plugin reads values from local.properties (which is ignored by Git) and exposes them as BuildConfig fields and manifest placeholders:

MAPS_API_KEY=your-restricted-maps-key

plugins {
    id("com.google.android.libraries.mapsplatform.secrets-gradle-plugin")
}
android {
    buildFeatures { buildConfig = true }
}

<meta-data android:name="com.google.android.geo.API_KEY" android:value="${MAPS_API_KEY}" />

Restrict client keys

• Application restrictions: limit to your package name and signing certificate SHA-1 (include the Play App Signing certificate).
• API restrictions: allow only the APIs the app uses.
• Quotas and alerts: cap usage and alert on spikes.

Remember that app restrictions rely on request metadata that a determined attacker can spoof. They limit casual abuse, not targeted attacks.

Real secrets: use a backend

For Gemini specifically, Firebase AI Logic with App Check provides this mediation without your own server. See Integrating Cloud AI APIs Securely.

If a secret leaks

1. Revoke or rotate the key immediately in the provider console.
2. Check usage logs and billing for abuse.
3. Remove it from history (rewrite Git history if needed) and from any published APKs, by releasing an update.
4. Fix the architecture so the secret no longer needs to be in the app.
5. Enable secret scanning on your repositories.

Common keys and where they go

Frequently asked questions

Conclusion

You can't hide secrets in an APK. Ship only public or restricted client keys, keep them out of Git with the Secrets Gradle Plugin, put real secrets behind a backend (or Firebase AI Logic with App Check for Gemini), and have a rotation plan for leaks.

Next step: decide whether pinning is right for your API in Certificate Pinning: Benefits and Limitations.