How to hide API Keys in flutter and still be able for your team to use your code base?


Asked by Zach G on November 13, 2021 (source).

I am using flutter and need to hide api keys and firebase plist files in both android and ios folders. What is the best way of going about this. I put them in the git ignore file however when my teammates pull it down from github they constantly have to get the firebase plist files and then they have to get the api keys again. Is there a better method?

This is my git ignore file



Question answered by VonC (source).

If you add those two files in .gitignore (and that is debatable for google-services.json), you are making clear, as explained here that others who build your code that they should be setting up their own Firebase project to host its configuration and data (because your project simply won't build with that file missing)

Other approaches are explained in this issue

  • Leave those files there (with fake data), as they are.
    If you want to override them in local, you can do so and then use this command to ignore the changes:

      git update-index --assume-unchanged GoogleService-Info.plist
  • Convert those files to "example" files, and add the original ones to gitignore.
    A setup task should convert the example files into real files if the real ones don't exist.