API key not protected

[cempo]

I have faced with one issue. Looks like anyone can decompile apk file and retrive API key and reuse it.
Do you have some recommendation how to protect it in case of using this library for Android projects?

[wilinz]

To ensure the security of your API key, you can store it on your server and create an HTTP service that forwards requests to the OpenAI API. You can also implement additional authentication methods such as cookies.

[aallam]

You should never store sensitive data like API keys on a user's device as it can be extracted by decompiling the APK. If sensitive data must be stored on the device, they should be encrypted and securely stored. However, understand that encryption only makes the task harder but not impossible.
Instead, either use a backend with authentication, or, store your API keys on a backend server and fetch them when needed. This not only enhances the security of your key but also gives you the flexibility to update it as necessary. Importantly, this method doesn't require users to update the app to get a new key, as it would if the key was embedded in the app.

[power-alex]

I used a firebase remote config to fetch a key and still someone was able to steal it. Is firebase remote config not suitable for that purpose?

[ddfire]

no, it is not