search

eucalypto / learn

These are projects that help me learn
0 stars 0 forks source link

API Key & Security #20

Open eucalypto opened 3 years ago

eucalypto commented 3 years ago

The tutorial for the Project PhotoGallery told me to create my own Flickr API key; and to use it directly in the source code.

But since I'm pushing it on GitHub, putting my API key into source control would be a faux pas. I think nowadays there are even bots that automatically warn people on GitHub when they pushed such things like API keys to their repositories.

I have full intention to avoid that such a bot will have to activate a warning here. :grin:

But how?

eucalypto commented 3 years ago

I followed this article https://dev.to/marwaeltayeb/hide-and-keep-your-api-key-out-of-github-repository-5768 In particular, the second option: using the local.properties file.

I added in the global scope of the file this line with my API key: FLICKR_API_KEY="XXXXXXXXXX...XXX"

local.properties is usually excluded from version control (git), so it won't end up in a github repository. But anyone who uses this source code to compile and run the app, must supply their own Flickr API key in this way (or another).

Here's another related article: https://medium.com/@enriqueramrezmanzaneda/managing-api-keys-in-android-builds-ddf56bb3b5a5