title: Security in Flutter: google_maps_flutter requires API Keys but how to provide them securely?
body: <h2>How this question is <em>not</em> a duplicate?</h2>
  <p>While @MrUpsidedown offers a few related questions in the comments section, none of them truly answer the part I tried to emphasize here: <strong>how to provide API keys <em>securely</em>?</strong></p>
  <p>After reading all the answers in the linked questions, I am inclined to write an answer myself.</p>
  <h2>Context</h2>
  <p>I am a very fresh Flutter developer who tries to integrate Google maps into a demo application.</p>
  <p>To save myself time, I decided to try the most popular Widget library for Google Maps which I was able to find, namely <a href="https://pub.dev/packages/google_maps_flutter" rel="noreferrer"><em><code>google_maps_flutter</code></em></a>. The library's terse documentation shows Android and iOS usage examples and both illustrate the API Keys are provided <em><strong>inline, as a part of the code base</strong></em>:</p>
  <pre class="lang-swift prettyprint-override"><code>import UIKit
  import Flutter
  import GoogleMaps
  
  @UIApplicationMain
  @objc class AppDelegate: FlutterAppDelegate {
    override func application(
      _ application: UIApplication,
      didFinishLaunchingWithOptions launchOptions: [UIApplication.LaunchOptionsKey: Any]?
    ) -&gt; Bool {
      GMSServices.provideAPIKey(&quot;YOUR KEY HERE&quot;) // &lt;------------------------------------  O--пп
      GeneratedPluginRegistrant.register(with: self)
      return super.application(application, didFinishLaunchingWithOptions: launchOptions)
    }
  }
  </code></pre>
  <pre class="lang-xml prettyprint-override"><code>&lt;manifest ...
    &lt;application ...
      &lt;meta-data android:name=&quot;com.google.android.geo.API_KEY&quot;
                 android:value=&quot;YOUR KEY HERE&quot;/&gt;  &lt;--------------------------------------  O--пп
  </code></pre>
  <p>Most developers know that the <strong>API keys must be stored securely</strong>. The code from the library documentation does not suite production application. The <a href="https://developers.google.com/maps/api-key-best-practices#best_practice_list" rel="noreferrer">Google Maps Platform documentation</a> explicitly warns against hard-coding API keys:</p>
  <blockquote>
  <p>Do not embed API keys or signing secrets directly in code.</p>
  <p>...</p>
  <p>Do not store API keys or signing secrets in files inside your application's source tree.</p>
  </blockquote>
  <h2>Problem</h2>
  <p>How do I use this package in a correct, secure way? Is it even possible?</p>
  <p>I hear a recurring idea a lot: &quot;<em>The client application can not be <strong>ever</strong> trusted storing API keys (and similar secrets/credentials) as it can be controlled, manipulated, or reverse engineered by a malicious user.</em>&quot; If this is the case, does it mean that I must consider <code>google_maps_flutter</code> package inherently insecure as long as it requires providing the Google Maps API key explicitly?</p>
  <p>I am also aware of the API key restriction. I will definitely use it, but it <em>seems to me</em> that it only reduces the &quot;blast radius&quot; if the API keys are compromised. I don't see, however, how that can prevent the API key leak and misuse by a third party.</p>
  <h2>P.S.</h2>
  <p>Initially, I wanted to pose my question more broadly: <s>Is there a way to securely deliver, store, and consume the secrets on mobile platforms (Android and iOS)?</s></p>