6

As per the documentation:

Do not include the API key anywhere in your client code.

And it is the case in our current Android app -- the API Key is nowhere included in the code. However, for the new version 3.0.0 of com.google.gms:google-services library, it started throwing error Missing api_key/current_key without it, as discussed here: Missing api_key/current key with Google Services 3.0.0.

Also, Google's config generator https://developers.google.com/mobile/add?platform=android&cntapi=gcm includes the API Key in the google-services.json file.

Is it supposed to be kept secret? Or is it safe to include it in the client app?

8
  • google-services.json file contain setup for GCM. That contain sender id and api_key. You need add it to module to config
    – mdtuyen
    Jul 8, 2016 at 1:20
  • I think the title should be "Is GCM API key supposed to be keep as secret".
    – Enzokie
    Jul 8, 2016 at 2:10
  • 1
    I haven't touched GCM in a couple of years. It used to be that there were two keys: a client key and a sender key. The client key had to be in the app, originally in a <meta-data> element in the manifest. I cannot quite imagine how GCM could work if there wasn't some client key that was used in the registration process. So, unless Google cooked up some miracle, I would assume that their documentation is in error and the client API key should be in the client app. Jul 9, 2016 at 11:15
  • 1
    @CommonsWare Thanks for your comment. As far as I remember it is the other way round. The SenderId used to be in the client app, which was used to generate the device token. And the API_KEY was used by server to identify with GCM. Check GCM API key vs Sender ID. That is why it was recommended not to include API key in the client app. However the confusion about the contradictory statements and why they need to include the it now? Jul 9, 2016 at 15:48
  • 2
    The client key does not need to be secret as you define all the allowed application IDs on the web config console for any given key. So even if someone gets your client key, they need to have your application ID too, which they can't get unless you give them your signing key. So keep your signing key secret and life is all good. Jul 9, 2016 at 20:29

3 Answers 3

6

The google-services.json file represents the configuration for all of the services available within Firebase. There are some services that require and "Android" API key. These are the API keys that you will find in the google-services.json file. Your app may or may not use these API keys depending on the Firebase APIs your app is using.

FCM has a "Server" API key that is used to send messages, this API key is NOT the key included in the google-services.json file. The server API key should never be included in your application. The google services plugin however does look for those Android API keys at build time and that could be the reason for your error, it is not because your FCM server API key is missing.

2
  • 2
    Thanks for the answer Arthur. It helps a lot. It makes sense that those 2 are not the same. Jul 11, 2016 at 19:12
  • Agreed this is a full explanation of why the client key security is not of concern. Jul 11, 2016 at 21:49
2

Answering my own question.

If I create a new test project on Firebase (https://console.firebase.google.com), it also includes the API Key into

  • google-services.json for Android app,
  • GoogleService-Info.plist for iOS app,
  • for Web App it even recommends to include the API key into my HTML.

Taken that HTML is definitely public, I'm pretty convinced now that it's not a secret.

0

If you are using GCM, your Android app need not know about the API key. I just had to include an empty field for api_key in the json file for GCM to work. As mentioned in tha answer here Missing api_key/current key with Google Services 3.0.0 and Maps API key in build.gradle, I just had to add a line like below in google-services.json for GCM to work:

"api_key": [
  {
      "current_key": ""
  }
],

I think you shouldn't include the API key, since I think only your server needs API key to authenticate with Google for requesting it to send push messages to intended recepients. It would be a risk if anyone gets hold of it. So file can look like:

{
  "project_info": {
    ...
  },
  "client": [
    {
      "client_info": {
         ...
      },
      "oauth_client": [
        {
          "client_id": "yourid.whatever.com",
          ...
        }
      ],
      "api_key": [
        {
          "current_key": ""
        }
      ],
      "services": {
       ...
      }
    }
  ],
  "configuration_version": "1"
}

Hope this helps.

6
  • 1
    But if you try to create google-services.json using Google's developers.google.com/mobile/… -- it puts API Key into google-services.json file.Same thing with Firebase: console.firebase.google.com/?pli=1 I don't believe they don't know what they're doing. Your solution might work, but since it's not documented anywhere I don't think it would be right to use it -- it may stop working any time. I wanted some more credible answer (e.g. from Google engineers). Jul 8, 2016 at 5:33
  • 2
    @DzmitryLazerka You haven't been an Android developer for very long, if you still assume anyone at Google knows what they're doing. Jul 8, 2016 at 7:20
  • To be frank, when I generated the json file for Firebase, there was no field for api_key field generated. It would be good if we can get an answer from someone from Google. Jul 8, 2016 at 14:25
  • Actually when I again download the json configuration file from Firebase like this, it doesn't include the current_key in my generated json. Jul 8, 2016 at 15:34
  • Interesting, I just tried again, and it does include API Key in it. If you click "Add Web App", it even recommends you to put it into HTML, which is definitely public. Jul 9, 2016 at 0:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.