You think your mobile app hides your keys

You code a mobile app written with whatever language, It works. API calls return data. Everything looks solid.

So you ship.

You tuck your API key inside:

• AndroidManifest.xml
• .env file
• Somewhere in your JS bundle

You feel safe because:

• Users don't see the code
• It's compiled into an APK

What you don't think about:

• Who else can use your API keys
• What happens when your app gets scraped
• How fast abuse can happen

A lot of devs treat security like something to “add later”.

That mindset is expensive.

Your app is public the moment it hits the Play Store or App store.

Real life situation that has happened before

A startup launched their app that uses Google API on the Store over the weekend.

Within 2 days after launch:

• 50,000 downloads and counting
• Strong traction
• Team celebrating

Everything looked like a win.

On Monday morning, the CTO received a budget alert from Google Cloud showing that costs had unexpectedly spiked to $15,450 after only a few days of usage.

No monetization yet. No revenue yet. Just a bill. A huge Minus

What actually happened

At first, they assumed a breach.

• Checked logs
• Looked for suspicious traffic
• Tried to trace an attacker

There was no hacker.

The problem was inside the app.

They had a Google Maps API key sitting in the AndroidManifest.xml.

Hardcoded. No restrictions. Free for all

Within minutes of launch:

• A bot scraped the APK
• Extracted the API key
• Started using it elsewhere and very fast 🤣

Not small usage.

Around 200 requests per second.

While the team celebrated downloads, someone else was burning their quota.

What actually happens behind the scenes

This is not advanced hacking.

Basic steps:

1. Download the app
2. Decompile using tools like JADX e.g for APK
3. Search for strings common to known API Keys format like AIza...
4. Extract the API key

That's it.

Now the key is usable anywhere:

• Scripts
• Bots
• Other apps

If there are no restrictions, you're paying for all of it.

Why “hiding it in the app” fails

Reverse Engineering exists

Even if you:

• Obfuscate code
• Rename variables
• Use .env files

It slows people down slightly. It doesn't stop them.

How to handle API keys properly

If you're building an app.

1. Treat the client as untrusted

Your app is not a secure environment.

Never assume:

• Secrets are safe
• Requests are genuine

Design like everything can be seen.

2. Move sensitive calls to your backend

Instead of:

App → Google Maps API

Do:

App → Your Server → API Call

Your server:

• Stores the real key
• Validates the request
• Controls usage

3. Restrict every key

Even with a backend, lock things down:

• Limit APIs the key can access
• Restrict by package name and SHA-1 (Android)
• Set quotas

If the key leaks, it won't work outside your setup.

4. Watch your usage

You should know when something is off.

Track:

• Requests per second
• Daily usage
• Sudden spikes

Set alerts early.

5. Rotate keys when needed

If a key is exposed:

• Revoke it
• Replace it
• Update your system

Don't leave old keys active.

---

Mobile apps are easy to reverse.

Not sometimes. Always.

If your API key sits inside the app, you've already exposed it.

The question is not if someone uses it.

It's when.

Speed is fine.

But skipping basic security is expensive.

Build like someone is already inspecting your APK.

Because they are.