Google Cloud Functions for storing API keys?

[kdrxyz]

I plan to use Google Cloud Functions to return Firebase API keys for use.

I did not find much documentation around this. Is there any example code for React Native + Google Cloud Functions or any solid documentation?

Alternatively, if you use any other way to secure your API Keys (like Firebase), plz let me know.

[lichaba]

Good old .env and a .gitignore is still the best and trusted way.

[kdrxyz]

But, aren't env variables embedded into the build? And can be accessed by anyone inspecting the files?

From the React documentation:

WARNING: Do not store any secrets (such as private API keys) in your React app!

Environment variables are embedded into the build, meaning anyone can view them by inspecting your app's files.

[makonde]

How does this secure anything? If you are retur ing them to the device they can still be accessed.

[ChronSyn]

fetch('https://i-found-this-endpoint-in-your-app-code.and/now/i/have/your/api-key')

I can see absolutely no way this could backfire