Never Put a Secret API Key Inside a Mobile App

Environment variables solved one problem for me earlier: I no longer had API keys sitting directly in source files or accidentally ending up in Git.

But that led to an important distinction I had not thought enough about before.

A value can be hidden from Git and still not be secret.

If I build a mobile application with a private API key included in its configuration, that value eventually has to reach the user’s device. Someone determined enough can inspect the application or its network behaviour and recover it.

So an .env file protects a secret from being committed to the repository. It does not make a client-side secret safe.

This became especially relevant while working with services that provide both public/client keys and private server-side keys. The names are there for a reason. A public key is designed to be used by the app. A secret key is designed to live somewhere the user cannot inspect.

The safer structure is usually:

mobile app
    ↓
my backend / serverless function
    ↓
external service using the secret key

The app asks my backend to perform the sensitive operation. The backend holds the credential and decides whether the request is allowed.

It is slightly more work than calling every service directly from the phone, but the alternative is effectively shipping the password together with the application.

My rule now is simple: if leaking a key would let someone spend my money, modify private data or perform privileged operations, it should not be inside the client app.