Develop Reference

Google Play Security alert about Google Cloud Platform (GCP) API keys

We were using a GCP API key on multiple platforms (Android, iOS, Web) for Google map, Location search (api/place/autocomplete), static Google Map, etc.
Now I wanted to create a new/separate Key for Android App so I can add appropriate restrictions like package name SHA1 and used APIs.
I've created a new key, Changed it into the App after that map is working fine but Location search API is kept throwing an exception-
This IP, site or mobile application is not authorized to use this API key. Request received from IP address <ip>, with empty referer",
Has anyone faced this issue? Or any clue that how should I debug this?

You cannot make web service requests using an API key that is Android or iOS restricted. Web services are server-side and only work with API keys that are restricted by IP address.
Each of your API keys should be restricted properly based on the API in use.
For web services, use an IP-restricted API key.
For client-side services, use an HTTP referrer-restricted API key.
For Maps and Places SDK for Android or iOS, use an Android/iOS restricted API key.
To learn more on API key restrictions for Google Maps APIs please check out these resources:
https://developers.google.com/maps/faq#keysystem
https://developers.google.com/maps/api-key-best-practices#restrict_apikey
Hope this clarifies your question!

I have the same issue, I'm using Android RN application but this could help to any mobile app (Native or React native), the issues come up with you are hardcoding your API KEY (this case google places API into your source code), in order to avoid it you should remove it and add it as System/environment variable, depend of what OS you using OS MAC or Windows, or you CI/ CD if you are delivery you app through it. I solved with the steps below:
I have to setup my System Environment variables in my local
environment in my case I'm using MacOS, Open terminal and run
export GOOGLE_PLACES_ANDROID_API_KEY=Insert_API_KEY_here
(optional but this is better)or copy it in ~/.bash_profile
Make sure my system/environment variable is there- use in the
terminal "printenv" -this will list those and there should be your
api key
GOOGLE_PLACES_ANDROID_API_KEY
Add android/gradle.properties the following line
# GOOGLE PLACES (we will replace this value DON'T COPY YOUR API KEY HERE)
GOOGLE_PLACES_ANDROID_API_KEY=HiHackerNoMyKey
Add the following lines in app/build.gradle inside defaultConfig
defaultConfig {
buildConfigField("String", "GOOGLE_PLACES_ANDROID_API_KEY", "\"${GOOGLE_PLACES_ANDROID_API_KEY}\"")
}
in my case I'm using Appcenter as CI so I added this line if we are building in CI and my CI should have my APIKEY in my system/environment variable already setup
[buildConfigField("String", "GOOGLE_PLACES_ANDROID_API_KEY", "\"${System.env.GOOGLE_PLACES_ANDROID_API_KEY}\"")](url)
and you can call it using java
Log.i(TAG, BuildConfig.GOOGLE_PLACES_ANDROID_API_KEY);
more reference
https://developer.android.com/studio/build/gradle-tips#simplify-app-development
I hope this helps!!

Keystroke from google play

I have a keystroke from google for my app. When I try to Export signed application package from eclipse, it gives me an option to either create a new keystore or to use an existing one.
As per my understanding I must use the "Base64-encoded RSA public key" that I got from Google. But there is no way I can download the key directly from the page where google displays it for me.
Can someone please let me know if I have to import it in someway or am I missing something?
Or should I just copy paste the key to some (binary) file in my project? Please help!

I have a keystroke from google for my app.
But there is no way I can download the key directly from the page where google displays it for me.
Which page is that? You shouldn't download a key in order to sign your application.
Or do you mean the debug.keystore which comes with the installation of the Android bundle? You can use it during development, but you need to create your own key when releasing the App. (Google Play won't accept an apk signed with the debug keystore)
If you are not releasing yet and you want to use the debug keytore - search your system for 'debug.keystore'. On Windows it can be in:
C:\Users\USERNAME\.android\debug.keystore
The passwords for the keystore and the android alias are android.
If however you want to create a new key for yourself - you can do that using the provided keytool as described here.
Finally, if you need an additional key for accessing some Google API (eg. Maps) with your App, then from the online developer console you need to create an additional Android key with the same fingerprint, as the one that you are signing the App with. This additional key is typically included in your manifest after that.
For reference, you can create new keys for your App here: https://console.developers.google.com

Google Maps Android API Authorization Failure when reusing api access key in android

I created one application and generated an api key, which worked and my app correctly renders map.
I created a second application, which is based on an Android Library project I created and I want to reuse the API_KEY of the first app. In https://code.google.com/apis/console, for my API debug project, I selected "Edit allowed Android apps...".
Then on a new line, I added the SHA1 certificate fingerprint and package name (separated by a semicolon) of my second project. So now that API Access key has the fingerprints of two apps associated with it.
However, when I test the second app on my android phone, logcat outputs
Google Maps Android API Authorization Failure.
The Certificate fingerprint of my second app is correct. My second app also references Google Play Services and is using Google API Level 16.
The second app manifest file is set up similarly to the first one, making reference to the debug API_KEY and having the same android permissions. What may I be doing wrong?

However, the recommended practice is to sign each of your applications with a different certificate and get a different key for each one.
https://developers.google.com/maps/documentation/android/start#getting_the_google_maps_android_api_v2
:D

I've previously found this helpful https://stackoverflow.com/a/13865113/935779
Make sure to export a signed copy with the same key you used to create your API key
This is often a problem when working with a Google Maps key and may very well be your issue. However, Nathvi is also correct from the documentation and you may consider a separate key if at all possible.

Install developing application and play store application in the same android phone

I had submitted an application to Google play store that is running on the real server.
On the other hand, I am still improving the application with a fake server. The reason of having 2 server is because all data in the fake server will not affect the real server.
Whenever I want to do demonstration with the real server, I have to uninstall the test app and download the real app on Google play stall. After the demonstration, I have to uninstall the real app and then install my test app on the android phone. It is kind of troublesome after doing this more than 2 times a day.
Is there any way I can install both the test and the real app on the same phone?
I tried to rename my package name. But I found the refactor function in eclipse not a clean renaming. I have to manually rename some of the file and this take up a lot of time.
Just wondering if there is any other better way to do it. It would be good if there are some suggestion that I can try.

Replace your debug key with your production key and set the appropriate passwords to allow the signing. This way Android will let you update/overwrite the old version.
In Eclipse, select Window --> Preferences--> Android --> Build
You can have your keystore pointed here
However, your key store must use the same profile name and password as the default key store.

Where should I put apiKey before publishing android application in Android market

I have signed and get this kind of code:
<com.google.android.maps.MapView
android:layout_width="fill_parent"
android:layout_height="fill_parent"
android:apiKey="0vzxVMvckBdI64O0FdGSRXawhfAlw"
/>
Then I put it to main.xml, under the . I run the project, it force close. The error is that XML can not find MapView. But I have add the library below. Moreover, I have test with google API Vitual machine, and it does not work too. Then I add Internet permission, and add:
<uses-library android:name="com.google.android.maps" />
under the in manifest, but it still does not work.
Could anybody tell me clearly step by step what I have to do, I am in a mess now and I can understand want to do next.
Before signed the apiKey, my application run well. Anybody help me.
Thanks in advance.

If you app worked well before signing your app then its the problem of you map Api key.
You can get a temporary Maps API Key based on your debug certificate, but before you publish your application, you must register for a new Key based on your release certificate and update references in your MapViews accordingly.
use adb to install the apk on your device/emulator (adb install app.apk). Don't forget to uninstall the debug version first, otherwise the signature difference will prevent the installation
EDIT:
When using GoogleMaps for Android, you need two keys - debug and release.
The "debug" key is kind of a misleading term. This key is also to be used when you develop the app in Eclipse. So essentially, use the debug key for development, testing, debugging.
When you're ready to launch the app to Market, set the android:debuggable="false" in the AndroidManifest.xml and use the Signed API key.
When using the signed API key, the MapView will show up ONLY when the app is installed from the Android Market. So, installing the app from Eclipse (Run As, Debug As, etc) or command line (adb install) won't show the MapView. Rest assured, once the app is in the Market - you download it and the MapView will show up.
With the signed API key, if you deploy the app from Eclise, you will get a "Server returned 3, IOProcessing Exception 26" as a warning - just ignore it.
Note: Also ensure there are no duplicate instances of the same MapView. If your app needs "x" no. of MapViews, generate "x" no. of new signed keys (one for each MapView) since GoogleMaps has a query limit for a single MapView instance.
For getting both the keys, follow the steps for Obtaining API keys for GoogleMaps on Android.