Search-only API keys on mobile
When running your app with the search only key embedded in your app, you might notice the following warning:
Warning: If you are building a native app on mobile, be sure to not include the search API key directly in the source code. Instead, fetch the key from your servers during the app’s startup
Implementation
Store your API key on a remote server, then fetch it with a network request when the app starts.
You can build this with server or serverless setups in most backend programming languages.
For an example, see this tutorial about getting API secrets from a server.
Secured API keys
As described in the previous section on Search Only Keys, mobile apps pose a security risk to your API keys.
Mobile apps are also inflexible, which makes secure operations harder.
API keys shouldn’t be hardcoded in shipped mobile applications.
Always fetch them dynamically from the application backend.
This is because users might not update your app as often as you’d like.
If you rotate your API key, or if it leaks and you need to revoke it, the installed app stops working.
Keep in mind that existing tools can open your app, even if it looks secure, and extract your API keys.
Don’t give your mobile app’s API keys more privileges than necessary.
Use Secured API keys with expiry times. 
