How to store API credentials in android and avoid decompilation attack?

Question

My end goal is to keep safe my API credentials and that cannot be discovered by decompiling the apk.

Currently, my API credentials are hardcoded at buid.gradle(app module) file.

When I decompiled my own apk using this site I can able to find the API url and other credentials.

Now I am looking for a solution and more interested to know how "google-services.json" file is getting parsed.

If there is a solution to read **my-cred.json** file under app folder at runtime or compile time (the same directory where **google-services.json** exists), I think I can protect my credentials from decompiling the source( correct me if I am wrong)

Please tell me a way to read **my-cred.json** or any other solution to protect the app credentials

Answer 1

In my opinion there is no way to protect this kind of private keys on your Android device. So the solution is simply not to store it on the Android device. But you can store it on an external server. In my case this key is used onyly once per session, to generate a session token. So I simply created a small java app that create the session token from the user id and the api key. That app is hosted on Google App Engine, but any hosting service should do the work. Then your Android app has to invoke this app (servlet) to get a proper token, which is then used to invoke the API.

I know this does not directly answer your question - but it's quite simple to put in place and will avoid your key to be reverse-engineered.