Saving the API Key in gradle.properties

Question

I am new to android and working on a project where I see that the API key that I got is saved in gradle.properties as :

MyOpenWeatherMapApiKey="1c3ae96f93a0094e8a7chsjdgfid04aed3f10"

And then in build.gradle(module:app) I am adding the following lines :

buildTypes.each {
            it.buildConfigField 'String', 'OPEN_WEATHER_MAP_API_KEY', MyOpenWeatherMapApiKey
      }

So, in my main program I am accessing the data using this api whose URL is got by this piece of code :

final String FORECAST_BASE_URL = "http://api.openweathermap.org/data/2.5/forecast/daily?";
            final String QUERY_PARAM = "q";
            final String FORMAT_PARAM = "mode";
            final String UNITS_PARAM = "units";
            final String DAYS_PARAM = "cnt";
            final String APPID_PARAM = "APPID";
            Uri builtUri = Uri.parse(FORECAST_BASE_URL).buildUpon()
                    .appendQueryParameter(QUERY_PARAM, params[0])
                    .appendQueryParameter(FORMAT_PARAM, format)
                    .appendQueryParameter(UNITS_PARAM, units)
                    .appendQueryParameter(DAYS_PARAM, Integer.toString(numDays))
                    .appendQueryParameter(APPID_PARAM, BuildConfig.OPEN_WEATHER_MAP_API_KEY)
                    .build();
            URL url = new URL(builtUri.toString());

So, my question is that why taking all the tension of doing changes to store the appid in the gradle part. Can't we access directly in the main program only ?

And the second part of my question is what is actually happening in the gradle part especially with the buildTypes.each{} block ?

Thanks. Your question helped me to configure my project. – Naveed Ahmad Nov 27 '16 at 15:37 — Naveed Ahmad, Nov 27 '16 at 15:37

score 45 · Answer 1 · edited Dec 14 '20 at 11:12

45

Refer - Complete implementation for storing API_KEY in gradle properties to avoid uploading to Github.

https://richardroseblog.wordpress.com/2016/05/29/hiding-secret-api-keys-from-git/

Add gradle.properties into .gitignore file
Add line in gradle.properties file API_KEY="CopyYourAPI_KEYhere"
Add below line in app/build.gradle within the defaultConfig

buildConfigField("String", "API_KEY", API_KEY)
Use Key using the following statement

String API_KEY = BuildConfig.API_KEY;

Copy this wherever you need API_KEY

It will save your efforts to add and remove API_KEY while committing code in Github.

edited Dec 14 '20 at 11:12

Boken

4,825
10
32
42

answered Jul 29 '18 at 16:49

gauravsngarg

606
5
11

This is a borderline [link-only answer](//meta.stackexchange.com/q/8231). You should expand your answer to include as much information here, and use the link only for reference. – Blue Jul 29 '18 at 17:10
Sure, I have added the details in short. If you have any query, please let me know. – gauravsngarg Jul 29 '18 at 18:19
1

this answer is easy to understand than others, thanks :) – Rucha Bhatt Joshi Jun 21 '19 at 10:20
This method requires that you remember to add the file to your .gitignore AND remove it from git since it's added by default. Furthermore the project-level file has other settings that you DO want to share with your team. It has its own issues, but the GLOBAL gradle.properties file is better for sensitive keys. – jj. Jan 20 '21 at 02:23
What if you want to use the KEY on a different module? – Duqe Aug 11 '21 at 12:54

score 43 · Accepted Answer · answered Mar 01 '16 at 12:44

43

The idea of this indirection is to allow you to store API key in files that are not uploaded to the version control: gradle.properties is a local file and should not be stored under the version control, and BuildConfig is a generated class, so it will only be created at build time. It's definitely easier to store the API key somewhere as a plain String, but then you'll have to commit it to the repo.
During build time, Gradle will generate the BuildConfig file to store some build-related constants. You can use buildConfigField command to instruct Gradle to add custom fields into BuildConfig. After the project is built, you can reference these constants inside your source code.

answered Mar 01 '16 at 12:44

Egor

39,695
10
113
130

1

Is it safe from reverse engineering on apk? – Sumit Shukla Aug 20 '20 at 09:26
1

@SumitShukla, it is not, the API key will still end up being a constant string that can easily be located upon decompilation. If you want some value to be safe from reverse engineering then it should live on the server. – Egor Aug 20 '20 at 14:15
1

Other similar ways that you can follow: https://guides.codepath.com/android/Storing-Secret-Keys-in-Android https://stackoverflow.com/questions/33134031/is-there-a-safe-way-to-manage-api-keys – Nah Mar 08 '21 at 06:05
If you put your API_KEY in your app, then you need to enable proguard to so that the key would be obfuscated. Otherwise a better approach to secure your api_keys is to save them in your server and get it during the runtime. – Sonu Sanjeev Jul 10 '21 at 15:49
1

@SonuSanjeev, I don't think proguard has a way to obfuscate string literals, but I might be wrong. – Egor Jul 12 '21 at 15:34
1

@Egor, Thanks for pointing it out. A quick googling thought me proguard obfuscates class names, method names and variable names but not the strings. – Sonu Sanjeev Jul 19 '21 at 12:25

score 14 · Answer 3 · edited Mar 28 '22 at 00:10

Saving the API Key in gradle.properties might not be a great idea. Using the local.properties file will be more convincing. Since local.properties file will by default be added in the git ignore file, I believe this will be a great place to add the API key.

To add the API_key in local properties you can follow these two simple steps below.

Step 1

Edit your local.properties file and add below code

sdk.dir=/Users/Library/Android/sdk
API_KEY=**Your Key**

Step 2

Edit your app-level build.gradle file and add the 'buildConfigField' inside defaultConfig as shown below.

Properties properties = new Properties()
    properties.load(project.rootProject.file('local.properties').newDataInputStream())

buildConfigField "String", "API_KEY", "\"${properties.getProperty('API_KEY')}\""

Note that per this post you will need to add quotes for String types

Step 3

Sync your project with Gradle changes.

Step 4

Rebuild your project from Build->Rebuild Project.

All done!! Now you can access the key by calling BuildConfig.API_KEY

Arunabh Das · Answer 4 · 2023-02-08T05:56:33.373

There is a better way

First make sure both build/ and local.properties are added to your .gitignore

build/

# Local configuration file (sdk path, etc)
local.properties

Add your APIKEY xyz123 to your local.properties as follows

apiKey="xyz123"

Next add the following block to the root level of your app build.gradle

def localPropertiesFile = rootProject.file("local.properties")
def localProperties = new Properties()
localProperties.load(new FileInputStream(localPropertiesFile))

Add the following line to the android block of your app build.gradle

buildConfigField("String", "API_KEY", localProperties['apiKey'])

Then, we may call the BuildConfig.API_KEY constant as follows

import app.unicornapp.mobile.android.unicorn.BuildConfig
import app.unicornapp.mobile.android.unicorn.BuildConfig.API_KEY
import retrofit2.http.Query


interface StockApi {
    suspend fun getListings(
        @Query("apikey") apiKey: String
    )

    companion object {
        val API_KEY = BuildConfig.API_KEY
    }

}

Since Android Gradle Plugin 8.0, the `BuildConfig` class is not generated by default. You can generate it by adding: `buildFeatures { buildConfig true }` to `build.gradle` — YaMiN, Jul 22 '23 at 19:46

Saving the API Key in gradle.properties

4 Answers4

Linked

Related