Storing API keys on the Realtime Database (Firebase)

Question

My android app requires using the Google Place Search API but since it's not available for android, I'll have to call the Web API. I've considered using Cloud Functions but that's too expensive and can be done for a lot less if done locally on each client. The problem is storing the API key on the user's devices as it can be easily retrieved. Thus is it safe if I store the key on the RT DB and reference it only when needed?

Also, if you have suggestions, I'd me more than happy to implement them :D

Frank van Puffelen · Accepted Answer · 2017-06-07 10:01:47Z

1

Storing the key in the database still requires that users can access it. So while it's one level more effort to retrieve, malicious users will still be able to retrieve it.

A server-side key should simply not be used in client-side code.

answered Jun 7, 2017 at 10:01

Frank van Puffelen

603k85 gold badges895 silver badges869 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Frank van Puffelen Over a year ago

As said: a server-side key should be used in server-side code (or some other trusted process). Recommending options for running server-side code is off-topic on Stack Overflow, but a quick Google search is bound to lead to many results of which I hope at least one will be within budget.

Gaurav · Accepted Answer · 2017-06-07 04:56:06Z

0

Google Places APIs are available for android.

Sample Code

public void findPlace(View view) {
try {
    Intent intent =
            new PlaceAutocomplete.IntentBuilder(PlaceAutocomplete.MODE_FULLSCREEN)
                    .setFilter(typeFilter)
                    .build(this);
        startActivityForResult(intent, PLACE_AUTOCOMPLETE_REQUEST_CODE);
    } catch (GooglePlayServicesRepairableException e) {
        // TODO: Handle the error.
    } catch (GooglePlayServicesNotAvailableException e) {
        // TODO: Handle the error.
    }
}

// A place has been received; use requestCode to track the request.
@Override 
protected void onActivityResult(int requestCode, int resultCode, Intent data) {
    if (requestCode == PLACE_AUTOCOMPLETE_REQUEST_CODE) {
        if (resultCode == RESULT_OK) {
            Place place = PlaceAutocomplete.getPlace(this, data);
            Log.i(TAG, "Place: " + place.getName());
        } else if (resultCode == PlaceAutocomplete.RESULT_ERROR) {
            Status status = PlaceAutocomplete.getStatus(this, data);
            // TODO: Handle the error.
            Log.i(TAG, status.getStatusMessage());

        } else if (resultCode == RESULT_CANCELED) {
            // The user canceled the operation.
        }
    }
}

Complete tutorial is available here.

answered Jun 7, 2017 at 4:56

Gaurav

2,0152 gold badges18 silver badges33 bronze badges

3 Comments

Krishna Keshan Over a year ago

This is a place autocomplete tutorial. What I'm looking for is the places search feature. You can query the API for a list of places by radius, place type, etc. and I think that's only available for web :/

Gaurav Over a year ago

Have you seen this (developers.google.com/places/android-api/placepicker) place picker tutorial for Android.

Krishna Keshan Over a year ago

Yup. But that only allows the user to select a certain place, while what I want is a list of nearby places. What do you think about the security aspect, will the API key be accessible by a (probably motivated) hacker if I store it in a variable?

Collectives™ on Stack Overflow

Storing API keys on the Realtime Database (Firebase)

2 Answers 2

1 Comment

3 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

1 Comment

3 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related