Android Here Maps set api keys programmatically

user_2372626 0
Viewed 972

I am using Here maps Premium SDK 3.15 and in the documentation, it says to set id, token, and license in the android manifest file. I set id, token, and license in build.gradle as a manifest placeholder and put in Android.manifest like below.

    <!-- Here Maps -->
    <meta-data android:name="com.here.android.maps.appid"
        android:value="${here_map_app_id}"/>
    <meta-data android:name="com.here.android.maps.apptoken"
        android:value="${here_map_app_code}"/>
    <meta-data android:name="com.here.android.maps.license.key"
        android:value="${here_map_licence_key}"/>

My project run into static code analysis and one of the finding is "Hard-Coded Secret Tokens Present in Application Code". It means I keep the here map credentials in build.gradle and it's not ok.

My question is where should I keep these credentials and is there a way setup Here maps SDK programmatically instead of Android. manifest (In case, I do not keep in the project and retrieve from Backend)

heremaps-android-sdk heremaps api-key android
3 Answers
user_84613440

You can use manifest placeholders: https://developer.android.com/studio/build/manifest-build-variables

and then place your keys in env or local.properties like below (build.gradle)

manifestPlaceholders = [
     HERE_SDK_APP_ID     : System.getenv("HERE_SDK_APP_ID") ?: "APP_ID",
     HERE_SDK_APP_TOKEN  : System.getenv("HERE_SDK_APP_TOKEN") ?: "APP_TOKEN",
     HERE_SDK_LICENSE_KEY: System.getenv("HERE_SDK_LICENSE_KEY") ?: "APP_LICENSE",
]

and in AndroidManifest.xml:

<meta-data
    android:name="com.here.android.maps.appid"
    android:value="${HERE_SDK_APP_ID}" />
<meta-data
    android:name="com.here.android.maps.apptoken"
    android:value="${HERE_SDK_APP_TOKEN}" />
<meta-data
     android:name="com.here.android.maps.license.key"
     android:value="${HERE_SDK_LICENSE_KEY}" />
user_96583070
user_137844370
Related