As per the documentation:
Do not include the API key anywhere in your client code.
And it is the case in our current Android app -- the API Key is nowhere included in the code. However, for the new version 3.0.0 of com.google.gms:google-services
library, it started throwing error Missing api_key/current_key
without it, as discussed here: Missing api_key/current key with Google Services 3.0.0.
Also, Google's config generator https://developers.google.com/mobile/add?platform=android&cntapi=gcm includes the API Key in the google-services.json
file.
Is it supposed to be kept secret? Or is it safe to include it in the client app?
<meta-data>
element in the manifest. I cannot quite imagine how GCM could work if there wasn't some client key that was used in the registration process. So, unless Google cooked up some miracle, I would assume that their documentation is in error and the client API key should be in the client app. – CommonsWare Jul 9 '16 at 11:15SenderId
used to be in the client app, which was used to generate the device token. And theAPI_KEY
was used by server to identify with GCM. Check GCM API key vs Sender ID. That is why it was recommended not to include API key in the client app. However the confusion about the contradictory statements and why they need to include the it now? – Shobhit Puri Jul 9 '16 at 15:48