Search code examples
firebaseflutterfirebase-cloud-messaging

Do I need to protect my firebase Server Key? Can I store it in the source code or is there a way to get it programatically?

Right now I have my Server Key for Firebase messaging hardcoded in my code.

Is this a security problem for when I deploy my app?

Can I get this key programatically?

Solution

  • Yes it's a security issue, According to this official document at the bottom says.

    Important: Do not include the server key anywhere in your client code. Also, make sure to use only server keys to authorize your app server. Android, iOS, and browser keys are rejected by FCM.

    And I don't think "get this key programmatically" is good idea because you still downloaded key to the client, or using other way to store in the client.