Where do people store API keys in Android

Question

Is there are a good practice for storing API keys in Android? I saw two possible places to do this: as meta data in the manifest, or as string resources in a separate resource file. I think that having them all in a separate resource file as string resources would be the best, because you can extract that file and not put it under source control. Then, I saw that Google Maps requires the API key to be specified as meta data in the manifest, and got a bit confused.

So, meta in the manifest, or string resources?

If you are asking about how to do meta data in manifest see: http://stackoverflow.com/questions/7928105/how-do-you-add-user-defined-properties-values-in-to-the-android-manifest-file — Morrison Chang, Sep 18 '13 at 18:26
@MorrisonChang I know how to do both, I am asking which is the preferred way. — Preslav Rachev, Sep 18 '13 at 19:12

score 0 · Answer 1 · answered Sep 18 '13 at 19:53

I would argue for any third party API key to be done as meta-data.

If you put in in strings.xml you'll need to prefix your API key with something unique which you'll hope will never have any name collisions.

Also string.xml is used for language translation so you would be requiring the app developer to break it out outside of string-es.xml, string-fr.xml, etc.

Where do people store API keys in Android

1 Answers1