title: Is it OK to use Firebase RemoteConfig to store API Keys?
body: <p>Note: For clarification this is not the Firebase API Key, this may be more like a token...something that the client app possesses, and the server endpoint verifies.</p>
  
  <p>We are trying to do even better to secure an API Key (think token that is used to validate a client to an endpoint).   This will all be on our internal network, but we still want to be sure that only our mobile client can call the endpoint.</p>
  
  <p>I was thinking that we could put the API Key in a Firebase remote config parameter (with an invalid default value built into the app).  However, the Firebase documentation for remote config says:  </p>
  
  <blockquote>
    <p>Don't store confidential data in Remote Config parameter keys or parameter values. It is possible to decode any parameter keys or values stored in the Remote Config settings for your project.</p>
  </blockquote>
  
  <p>I wasn't sure if this is just referring to the default values that are bundled with the app, or if it is also for values that are loaded remotely.  Once we have the key, we can encrypt it and store it on the device via our MDM provider.</p>
  
  <p>Also, is the transfer of the remote config data to the app encrypted or done clear text?</p>
  
  <p>Thanks for any more information that anyone can provide about the remote config.</p>