Git: track or untrack Android API keys?

Question

I'm using Google Maps API for Android. I push my code onto Github from my desktop and then download it off Github onto my laptop when I want to work on code while travelling.

In terms of Google Maps API, I need to put the API key in the android manifest like this:

<application>
  ...
  <meta-data
      android:name="com.google.android.geo.API_KEY"
      android:value="YOUR_API_KEY"/>
</application>

Now, because I have two different debugging certificate (the one on the laptop and the one on the desktop), the API keys from google would also be different as the SHA-1 fingerprint from the debugging certificates would differ.

How do I keep this unique on both PCs?

I think it is necessary to track the android manifest on git as that's quite an important component of any app but now how do I avoid conflicts in the API key each time I push?

I had same issue, so I added both devices SHA-1 , which was the easiest — Chathura Wijesinghe, Oct 04 '15 at 10:22

score 6 · Answer 1 · answered Oct 04 '15 at 10:00

I think VonC way is probably the most correct way to do it but I have also come up with a quick workaround.

You would create a separate custom xml file under the values.xml folder, call it whatever you want. I called mine constants.xml

Inside the xml, you would add in your api key:

<?xml version="1.0" encoding="utf-8"?>
<resources>
    <item name="google_places_geo_api" type="string">APIKEY</item>
</resources>

I have kept it separate from strings.xml so that I don't have to track this file on git. I do track strings.xml on git.

On your manifest:

<meta-data
    android:name="com.google.android.geo.API_KEY"
    android:value="@string/google_places_geo_api"/>

Run and the api key gets pulled from the constants.xml file.

score 2 · Accepted Answer · edited May 23 '17 at 10:30

2

Don't track the android manifest: generate it automatically on git checkout.

That is called a smudge script, part of a content filter driver, using using .gitattributes declaration.

^{(image from "Customizing Git - Git Attributes", from "Pro Git book")}

That 'smudge' script( that you have to write) would need to:

detect its environment
fetch the right key (possible from another file already tracked, and which would list those keys)
generate the manifest, using a tracked manifest template with placeholder value in it to replace.

edited May 23 '17 at 10:30

Community

1
1

answered Oct 04 '15 at 09:46

VonC

1,262,500
529
4,410
5,250

1

Thanks - I might need to do some more investigation as this is the first time I have heard of a smudge script but thanks for putting me in the right direction. – Simon Oct 04 '15 at 09:52

score 2 · Answer 3 · answered Oct 04 '15 at 10:09

I know there's an accepted answer AND a very clever workaround by the OP, but I guess there is an even easier way of doing it.

The key problem arises when you have different debug certificates in different PCs. The same problem is also true if you have a group of developers working on the same app. And what we do on the place I work is to simply use the same debug key on every computer. Kill the problem on its root.

The 1st developer who did the Maps API code passed to me and the other developer his debug.keystore and you replace this file on your PC.

for Mac and Linux running Android Studio this file is located in $HOME/.android/debug.keystore

Having this file replaced means not having to worry with any API key at all. You can even check-in this file into GIT to make sure it doesn't get lost.

Thanks, I might try this later. This would help me a lot and I dont have to reregister on apis. — Simon, Oct 04 '15 at 10:13
I gave the content filter driver as a "native git" solution, but this one might be an even better fit. +1 — VonC, Oct 04 '15 at 11:24

score 1 · Answer 4 · answered Oct 05 '15 at 08:43

1

Just add both devices' SHA-1 with same package name

answered Oct 05 '15 at 08:43

Chathura Wijesinghe

3,310
3
25
41

Git: track or untrack Android API keys?

4 Answers4

Related