title: Securely Saving API Keys In Android (flutter) Apps
body: <p>I know that this question has been asked many times. I've read all of them. I've searched this in Google but I still have questions that I wasn't able to find answers for.</p>
  
  <p>Currently I'm storing API Keys in my app. Which yes is a bad practice. Now to the best of my knowledge I can use ProGaurd or DexGaurd to obfuscate. I can also use Keystore to securely store my api keys. Now for this part here' my question:
  - Obfuscation changes the name of variables and classes. My API Key will still be in that app when someone decompiles the apk file. Sure it might take more time, but how much more is it? For example 20 minutes? I feel like the bottom line is that they can use this key if they put some time and effort. Am I getting this wrong?</p>
  
  <p>Now the other answer that I've seen on different websites was that I can store my keys on a server and then communicate that through my app. </p>
  
  <ul>
  <li><p>How is that even possible? A server is going to send the api key to the app. If the hacker finds this url they can just open it and get the key. If I use a key to access the URL then i'm entering a never ending loop of keys. How would I do this?</p></li>
  <li><p>Someone said that I can encrypt my keys and then decrypt them in the app once it's received. But can't people decompile my decryption function and figure out my key?</p></li>
  </ul>
  
  <p>I was also told that Firebase Remote Config is going to be a safe method for storing my keys. But then there's another problem</p>
  
  <ul>
  <li>How much safer is this method?</li>
  <li><p>If I'm using a google services json file to identify my project, can't just people get my keys from the remove config part? Because I can't see any settings for remove config on my console in order to say who can access this and who can't. How can I securely store my api keys on Firebase?</p></li>
  <li><p>And can't hackers just decompile the apk and just change the code and extract data from my firebase account? Because the google services json is there. If they print the data extracted can they access everything?</p></li>
  </ul>
  
  <p>So what exactly should I do to safely use api keys for my third party applications? And some of these api keys are very valuable and some of them just get information from other servers. I just want to know the safest method to store these keys.</p>