API key restrictions

[exerlog]

API key restrictions

[k-rokicki]

About adding google-services.json to .gitignore - I agree if the documentation mentions that this file should be placed in that directory, otherwise I would leave the file where it is, possibly with credentials set to ""

[HacDan]

This should be added to the .git ignore and invalidated by @KalleHallden. Security wise this should never be public.

[k-rokicki]

Well, not really - as mentioned in the SO thread above:

When using the plugin the way Google intends you to, it will unfortunately be easy for anyone unzipping your APK to get hold of your Firebase/Google API Key.

The API key becomes public as soon as you publish your app to Google Play, so I believe the way to go is to set key restrictions properly.

[HacDan]

I was referring to a little farther down the thread.

Also note that, although they are public for your application, these files should not be made available on public repositories of open source projects.

Edit: Markdown support on mobile is horrible.

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs.
Thank you for your contributions.

[justChris]

Actually the auto generated firebase keys do not need to be restricted generally. There are a few cases where restriction is recommended though. See the following documentation.
https://firebase.google.com/docs/projects/api-keys#apply-restrictions

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs.
Thank you for your contributions.