DEV Community

Kiolk
Kiolk

Posted on

4

Simple way to store secrets in Android Project.

Very often, we should store secrets that we need to build android application. One of the most common cases are storing key alias, key password and store password, that are need to build production release. It is not problem when you develop application in solo in your own private repository. If your team grows to two developers, or you want to move the project to open source, you should store this secrets outside of version control. 

The best candidate for this is Gradle local.properties file, that doesn't track by git by default. In this file, you can store key-value pairs by very simple syntax.  In our example, it looks like this:

#sign configuration
key_alias=SomeAlias
key_password=SomeKeyPassword
store_password=SomeStorePassword
Enter fullscreen mode Exit fullscreen mode

After, you can use it for signing configuration in build.gradle.kts file, you need only read these values and store in variables:

val localProperties = Properties()
val localPropertiesFile = rootProject.file("local.properties")
localProperties.load(FileInputStream(localPropertiesFile))

val aliasKey: String = localProperties.getProperty("key_alias")
val passwordKey: String = localProperties.getProperty("key_password")
val passwordStore: String = localProperties.getProperty("store_password")
Enter fullscreen mode Exit fullscreen mode

Late, you can simply use it in places where they need:

signingConfigs {
        create("release") {
            keyAlias = aliasKey
            keyPassword = passwordKey
            storePassword = passwordStore
            storeFile = rootProject.file("keystore/release.keystore")
        }
    }
Enter fullscreen mode Exit fullscreen mode

If you need to use these secrets in code, you can simply store it in variables of BuildConfig . But this way is not very secure, because they will be visible after revers engineering of your application.

buildConfigField("String", "PRIVATE_ACCESS_TOKEN", "\"${privateAccessToken}\""
Enter fullscreen mode Exit fullscreen mode

It is all. After this simple manipulation, you can feel itself safety. Also, I like to add information about required local variables in README with pointing where you can find it for saving time of developer who will join to projec.

Heroku

This site is built on Heroku

Join the ranks of developers at Salesforce, Airbase, DEV, and more who deploy their mission critical applications on Heroku. Sign up today and launch your first app!

Get Started

Top comments (0)

A Workflow Copilot. Tailored to You.

Pieces.app image

Our desktop app, with its intelligent copilot, streamlines coding by generating snippets, extracting code from screenshots, and accelerating problem-solving.

Read the docs

👋 Kindness is contagious

Discover a treasure trove of wisdom within this insightful piece, highly respected in the nurturing DEV Community enviroment. Developers, whether novice or expert, are encouraged to participate and add to our shared knowledge basin.

A simple "thank you" can illuminate someone's day. Express your appreciation in the comments section!

On DEV, sharing ideas smoothens our journey and strengthens our community ties. Learn something useful? Offering a quick thanks to the author is deeply appreciated.

Okay