Starting May 1, 2024,
Apple requires all iOS apps to include a privacy manifest.
For more information, see Privacy manifest. Don’t embed search-only API keys on mobile
When running your app with the search only key embedded in your app, you might notice the following warning:
This follows the mobile security recommendations, because people could access this key.
Keeping your key on your server also gives you more flexibility.
You can change the key without shipping a new app version to the App Store.
Implementation
Store your API key on a server, and fetch it through a network request when the app starts.
You can set this up in many ways, using any programming language you prefer.
For example, see this tutorial on fetching a remote configuration file.
Secured API keys
Mobile apps pose security risks to your API keys.
They’re also harder to update, which makes secure key management more difficult.
Don’t hard-code API keys in mobile apps you ship.
Always retrieve them dynamically from your app’s backend.
Users might not update your app as often as you’d like.
If you rotate your API key, or need to revoke a leaked key, apps that still use the old key stop working.
Existing tools can open a mobile app, even one that looks secure, and extract its API keys.
Don’t give your mobile app’s API keys more privileges than necessary.
Use Secured API keys with expiration times. Last modified on September 16, 2026
