When running your app with the search only key embedded in your app, you might notice the following warning:
Be sure to not include the search API key directly in the source code.You should instead consider fetching the key from your servers during the app's startup
This follows the mobile security recommendations, because people could access this key.
Keeping your key on your server also gives you more flexibility.
You can change the key without shipping a new app version to the App Store.
Store your API key on a server, and fetch it through a network request when the app starts.
You can set this up in many ways, using any programming language you prefer.
For example, see this tutorial on fetching a remote configuration file.
Mobile apps pose security risks to your API keys.
They’re also harder to update, which makes secure key management more difficult.Don’t hard-code API keys in mobile apps you ship.
Always retrieve them dynamically from your app’s backend.
Users might not update your app as often as you’d like.
If you rotate your API key, or need to revoke a leaked key, apps that still use the old key stop working.Existing tools can open a mobile app, even one that looks secure, and extract its API keys.
Don’t give your mobile app’s API keys more privileges than necessary.
Use Secured API keys with expiration times.
