title: how to obfuscate google keys in Android using ProGuard
body: <p>I have been searching this solution everywhere but I cannot make it work yet. My google API key is stored in a string inside res folder, I have enabled proguard in my project, set the properties, later generating the APK (tried both unsigned and signed) but still being able to do reverse engineering to my generated APK to get the Google Key again (using Android Studio or even <a href="http://www.javadecompilers.com/apktool" rel="nofollow noreferrer">http://www.javadecompilers.com/apktool</a>).</p>
  
  <p>Google recommends in their documentation to store API keys in the res folder to use it in the manifest, but never explains how to help with reverse-engineering security on that key.</p>
  
  <p>My <code>AndroidManifest.xml</code> has this piece of code:</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="utf-8"?&gt;
  &lt;manifest xmlns:android="http://schemas.android.com/apk/res/android"
      package="com.proyecto.cutcsa.cutcsa" &gt;
      ...
  
      &lt;application
          android:allowBackup="true"
          android:icon="@drawable/app_icon"
          android:label="@string/app_name"
          android:theme="@style/AppTheme"
          android:name="android.support.multidex.MultiDexApplication"&gt;
  
          ...
  
          &lt;meta-data
              android:name="com.google.android.geo.API_KEY"
              android:value="@string/google_key" /&gt;
  
      ...
      &lt;/application&gt;
  
  &lt;/manifest&gt;
  </code></pre>
  
  <p>My <code>build.gradle</code> has the next:</p>
  
  <pre><code>apply plugin: 'com.android.application'
  
  android {
      compileSdkVersion 25
      buildToolsVersion "23.0.3"
      useLibrary  'org.apache.http.legacy'
  
      defaultConfig {
          applicationId "com.proyecto.cutcsa.cutcsa"
          minSdkVersion 16
          targetSdkVersion 25
          versionCode 1
          versionName "1.0"
          multiDexEnabled true
      }
      buildTypes {
          release {
              debuggable false
              minifyEnabled true
              shrinkResources true
              proguardFiles getDefaultProguardFile('proguard-android.txt'), 'proguard-rules.pro'
          }
  
          debug {
              debuggable false
              minifyEnabled true
              shrinkResources true
              proguardFiles getDefaultProguardFile('proguard-android.txt'), 'proguard-rules.pro'
          }
      }
  
      dexOptions {
          javaMaxHeapSize "4g"
      }
  }
  dependencies {
      ...
  }
  </code></pre>
  
  <p>And my `proguard-rules.pro
      -optimizationpasses 5    </p>
  
  <pre><code>-dontusemixedcaseclassnames    
  
  -dontskipnonpubliclibraryclasses
  
  -dontpreverify
  
  -verbose
  
  -optimizations !code/simplification/arithmetic,!field/*,!class/merging/*
  
  -keep public class * extends android.app.Activity
  -keep public class * extends android.app.Application
  -keep public class * extends android.app.Service
  -keep public class * extends android.content.BroadcastReceiver
  -keep public class * extends android.content.ContentProvider
  -keep public class com.android.vending.licensing.ILicensingService
  
  -assumenosideeffects class android.util.Log {
      public static *** d(...);
      public static *** v(...);
  }
  
  -keepclasseswithmembernames class * {
      native &lt;methods&gt;;
  }
  
  -keep public class * extends android.view.View {
      public &lt;init&gt;(android.content.Context);
      public &lt;init&gt;(android.content.Context, android.util.AttributeSet);
      public &lt;init&gt;(android.content.Context, android.util.AttributeSet, int);
      public void set*(...);
  }
  
  -keepclasseswithmembers class * {
      public &lt;init&gt;(android.content.Context, android.util.AttributeSet);
  }
  
  -keepclasseswithmembers class * {
      public &lt;init&gt;(android.content.Context, android.util.AttributeSet, int);
  }
  
  -dontwarn java.awt.**
  
  -keepclassmembers enum * {
      public static **[] values();
      public static ** valueOf(java.lang.String);
  }
  
  -keep class * implements android.os.Parcelable {
    public static final android.os.Parcelable$Creator *;
  }
  
  -keepclassmembers class **.R$* {
      public static &lt;fields&gt;;
  }    
  </code></pre>
  
  <p>Can somebody help me with this problem? I will really appreciate it. Thank you in advance!</p>