Question

Your app contains exposed Google Cloud Platform (GCP) API keys. Please see this Google Help Center article for details

My key is restricted using package name and SHA1, still Google Play store shows this warning.

Any idea why it is showing like this. I defined my API key in build.gradle file and using it from there.

 46  37425  46
1 Jan 1970

Solution

 20

As per google's recommendation putting restrictions such as specifying the package name and also the SHA-1 key is the way to go.

It has been explained here: https://cloud.google.com/docs/authentication/api-keys#securing_an_api_key

Now, the problem here is that whatever you do your API key will end up in the codebase i.e if you specify it outside your codebase (via some properties file) but pass it in via the BuildConfig field during the build phase (the whole key is visible to someone decompiling your code as it is now part of BuildConfig class file) or you split it up and concatenate in the codebase (the split keys are still visible and anyone can concatenate them by seeing the usage to get the final key from a decompiled apk).

The split key version will get rid of the warning in the Play Console, but the key is still exposed.

My suggested solution thus would be to encode your API key and pass that around your codebase. Just before using it you decode it back.

A very simple example can be:

Please use a better encoding algo and not this, this is for demonstration purpose only. Here we are using Base64 encoding.

import android.util.Base64

fun main() {
   // API Key = "123456ABC"
   val myEncodedApiKey = "MTIzNDU2QUJD" // Should be passed via BuildConfig
   val decodedApiKey = Base64.decode(myEncodedApiKey, Base64.DEFAULT)

   // Now use `decodedApiKey` in your codebase.
   val decodedApiKeyString = String(decodedApiKey)
}

Why is this better?

  1. Your key is not exactly the same as in your GCP project.
  2. The play console when it scans your codebase, cannot match it back to your GCP project API keys. Thus no warnings.

Update (clarification on using the google-services.json file for API key):

The solution to use the API key from google-services.json isn't quite valid. google-services.json is generated file usually if you connect your firebase account. The API key defined there has a different restriction model. The one you define in your GCP project is different, allowing you to pass in package name and an SHA-1 key as well as restricted to a specific kind of API access such as Youtube only access. So if one was to use the API keys from google-services.json then you are essentially not using the restrictions you set up in your GCP account. GCP accounts do not generate google-services.json file.

To bring into perspective here is an official doc from Google for setting up Youtube API which uses GCP project defined API keys and in the docs, it mentions to directly put the keys in the code. (which is anyways wrong as it is exposed, but that's Google for you).

https://developers.google.com/youtube/android/player/setup

Nowhere in any docs, it is referred to use google-services.json file for retrieving API keys.

2019-07-22

Solution

 6

You can remove this warning by split your keys into 4 parts like this

public static final String API_KEY_PART_1 = "Asdsdfdd-";

public static final String API_KEY_PART_2 = "dfsFdsdsFdd";

public static final String API_KEY_PART_3 = "Pgdhs_SfSfs";

public static final String API_KEY_PART_4 = "fdfDDSD";

and use it by concatenate Strings 

.attest(nonce.getBytes(), Constants.API_KEY_PART_1+Constants.API_KEY_PART_2+Constants.API_KEY_PART_3+Constants.API_KEY_PART_4)

NOTE: Make sure you restrict your API key to Applications Access only. otherwise if someone decompile your apk and use your api key then it may be increase your billing.

Restric your API's Key with SHA & Package name click here for details

2019-07-10