GCP API keys Your app contains exposed Google Cloud Platform GCP API keys

Question

When uploading a build to the Google Play Store Console, an issue occurs. 

The mistake is as follows.

Leaking GCP API Keys 

Keys to Google Cloud Platform (GCP) APIs are exposed in your app.

The offending code is listed below.

Places.initialize(getApplicationContext(), BuildConfig.GOOGLE_API_KEY);

I am reading the key from BuildConfig and also restricting it, as per the guidelines. But the problem is still there. How can I resolve this problem?

Answer 1

You must look under "Credentials" in the Cloud Platform Console to safeguard your GCP API Keys. Using the Create credentials button, generate a new API Key with the same configuration as the compromised API Key. You risk experiencing an outage if the limitations on the API Key do not line up.
The old key was deleted after pushing the new one to all the areas where it was previously active.
For further information, I advise you to look at the official documentation for handling compromised credentials in GCP.
In addition, you may wish to take into account Keyless API authentication by utilizing workload identify federation.

Hope this helps!

Get GCP Certification and become certified today!