All 7 Flutter App Security Best Practices questions
More in Flutter App Security Best Practices
How does the flutter_secure_storage package let you securely store sensitive data, such as an authentication token, on a user's device using each platform's own native secure storage mechanism? Why is enforcing certificate pinning important for a Flutter app handling genuinely sensitive data, and how does it help protect against a man in the middle attack? How can code obfuscation help protect a Flutter app's actual business logic from being easily reverse engineered by an attacker who obtains a copy of the compiled release build? How should a Flutter app properly validate and sanitize any data received from a server, rather than blindly and unconditionally trusting that all incoming data is genuinely already safe and well formed? How do biometric authentication methods, such as fingerprint or face recognition, add an additional meaningful layer of security to a sensitive Flutter app, and how does the local_auth package help implement this feature? How should a Flutter app properly detect whether it is currently running on a rooted Android device or a jailbroken iOS device, and what genuine security risks does running on such a compromised device actually introduce?
Advertisement
Flutter › Flutter App Security Best Practices

Why should sensitive information, such as an API key or a secret token, never be hardcoded directly within a Flutter app's actual source code?

Beginner

Answer

Since a compiled Flutter app, particularly on Android, can genuinely be decompiled and its embedded strings extracted by a sufficiently determined attacker, hardcoding a sensitive API key or secret token directly within your source code means that value can potentially be discovered and misused by anyone who obtains a copy of your published app, and appropriately sensitive values should instead be kept on a secure backend server whenever genuinely possible, or at minimum protected using platform specific secure storage and appropriate build time configuration rather than being embedded directly as a plain, visible string within your source code.
// Avoid this
final apiKey = 'sk_live_abc123xyz';

// Prefer fetching sensitive operations through your own backend instead
Real-world example A payment processing app moves its actual sensitive secret API key entirely to a secure backend server, having the Flutter app itself only ever communicate with that backend rather than ever directly embedding the genuinely sensitive key within the client app itself.

Common follow-ups: What is the difference between a public and a secret API key in terms of how safely each one can actually be embedded within a client app?;How easily can a compiled Flutter Android app actually be decompiled by an attacker?

Networking with HTTP & Dio;Firebase Authentication in Flutter
All 7 Flutter App Security Best Practices questions