What is the best way to store api keys on flutter? - flutter

Question

I want to store an api key on my flutter app. I was thinking about requesting the api key from the server on user registration, and then save it with flutter_secure_storage.
Is that a good way to get and store api keys?

Answer 1

As seen here.
The most secure way to keep your keys as secret, is to NEVER put them in your app because someone could decompile your app and get them, but if you really want to store them in the app the most recommended approach I have found is using text assets. In Flutter you just need to load your file containing your secret keys as if your were loading any other asset.
Create a file called secrets.json that will keep our secret API keys. And store it in the root directory of our project. Remember not to commit your secrets.json file to version control.
write an entry in pubspec.yaml pointing to our secret file.
assets:
- secrets.json
define the class that will keep our keys, let’s say it’s called Secret
class Secret {
final String apiKey; Secret({this.apiKey = ""});
factory Secret.fromJson(Map<String, dynamic> jsonMap) {
return new Secret(apiKey: jsonMap["api_key"]);
}
}
Then a SecretLoader
import 'dart:async' show Future;
import 'dart:convert' show json;
import 'package:flutter/services.dart' show rootBundle;class SecretLoader {
final String secretPath;
SecretLoader({this.secretPath}); Future<Secret> load() {
return rootBundle.loadStructuredData<Secret>(this.secretPath,
(jsonStr) async {
final secret = Secret.fromJson(json.decode(jsonStr));
return secret;
});
}
}
After that, you can just use your SecretLoader like this:
Future<Secret> secret = SecretLoader(secretPath: "secrets.json").load();

Answer 2

Definitely yes from me! It is a best way to store data in secure storage
flutter_secure_storage: ^4.2.0

Answer 3

I'm running into this same question on best practices for API keys in Flutter. I've read many responses across multiple stack posts. It seems that no matter what we do, someone dedicated enough will get the API key so we must turn our attention to limiting the actions of the API.
I'm using Algolia in my project so I'm going to use this service as an example. This service gives you multiple API keys. One of them is for "search only" and another is the ADMIN API key.
The Search Only API key comes with parameters that you can set to prevent API abuse and additionally only allows reads, and does not allow writes or deletes. The Search only API key is what we will expose in our front end and NEVER expose our Admin API key.
I will still follow best practices on utilizing gitIgnore and doing my best to prevent API compromise but from what I've gathered it seems the most effective method is at the API source. I hope this helps in some way.