79707023

Date: 2025-07-19 07:15:15
Score: 0.5
Natty:
Report link

Restrict the API keys to the bundle ID

The suggestions about creating a proxy-server for this is completely out of the question for a mobile apps. Things you can put on the server, you should absolutely put on the server, but if your goal is to show a Google map on the mobile device using native controls, this is not an option.

If you're using things like Places API to look up addresses, you should absolutely put that on the server.

In google cloud console restrict the API key to the bundle ID on iOS and to the package name and SHA-1 fingerprint on Android.

Then you should rotate your keys from time to time.

The code labs provided by google on this integrates with the underlying maps SDKs used in the flutter package in the same way as the flutter package.

https://developers.google.com/codelabs/maps-platform/maps-platform-ios-swiftui#5

Reasons:
  • Long answer (-0.5):
  • No code block (0.5):
  • Low reputation (0.5):
Posted by: Jørgen Andersen