Git: track or untrack Android API keys?

Question

I'm using Google Maps API for Android. I push my code onto Github from my desktop and then download it off Github onto my laptop when I want to work on code while travelling.

In terms of Google Maps API, I need to put the API key in the android manifest like this:

<application>
  ...
  <meta-data
      android:name="com.google.android.geo.API_KEY"
      android:value="YOUR_API_KEY"/>
</application>

Now, because I have two different debugging certificate (the one on the laptop and the one on the desktop), the API keys from google would also be different as the SHA-1 fingerprint from the debugging certificates would differ.

How do I keep this unique on both PCs?

I think it is necessary to track the android manifest on git as that's quite an important component of any app but now how do I avoid conflicts in the API key each time I push?

Answer 1

Just add both devices' SHA-1 with same package name

Answer 2

I know there's an accepted answer AND a very clever workaround by the OP, but I guess there is an even easier way of doing it.

The key problem arises when you have different debug certificates in different PCs. The same problem is also true if you have a group of developers working on the same app. And what we do on the place I work is to simply use the same debug key on every computer. Kill the problem on its root.

The 1st developer who did the Maps API code passed to me and the other developer his debug.keystore and you replace this file on your PC.

for Mac and Linux running Android Studio this file is located in $HOME/.android/debug.keystore

Having this file replaced means not having to worry with any API key at all. You can even check-in this file into GIT to make sure it doesn't get lost.

Answer 3

I think VonC way is probably the most correct way to do it but I have also come up with a quick workaround.

You would create a separate custom xml file under the values.xml folder, call it whatever you want. I called mine constants.xml

Inside the xml, you would add in your api key:

<?xml version="1.0" encoding="utf-8"?>
<resources>
    <item name="google_places_geo_api" type="string">APIKEY</item>
</resources>

I have kept it separate from strings.xml so that I don't have to track this file on git. I do track strings.xml on git.

On your manifest:

<meta-data
    android:name="com.google.android.geo.API_KEY"
    android:value="@string/google_places_geo_api"/>

Run and the api key gets pulled from the constants.xml file.

Answer 4

Don't track the android manifest: generate it automatically on git checkout.

That is called a smudge script, part of a content filter driver, using using .gitattributes declaration.

^{(image from "Customizing Git - Git Attributes", from "Pro Git book")}

That 'smudge' script( that you have to write) would need to:

• detect its environment
• fetch the right key (possible from another file already tracked, and which would list those keys)
• generate the manifest, using a tracked manifest template with placeholder value in it to replace.