Leaked GCP API Keys - android-security

We have followed the google instructions on how to prevent this error from coming up in Play Store. i.e. our keys are specified in the gradle local.properties file. We built and are referencing the keys from our app as follows:-
Places.initialize(context, BuildConfig.keyname);
The error still comes up in Google Play Console. How do we prevent this from happening?

Related

android-security. - Leaked GCP API KEY

We are getting this error message when publishing app update:
Your app contains exposed Google Cloud Platform (GCP) API keys. Please see this Google Help Centre article for details.
I can follow the instructions and restrict the API Key for Android App by entering package name and SHA-1 certificate fingerprint, but my question is will this somehow affect Google Sign In as the app is available to production.
Like for instance any issues through logging in or something ?
Still haven't tried to perform the instructions due to concerns that it might prevent Google Sign In from working

Firebase google-sign-in fails in production, Linking to Google Play: An error occurred while trying to link

I created and upload an app with google sign-in to google play, it works in debug mode and in release mode
I had to follow:
Generate SHA-1 for Flutter app
and Google sign in failed com.google.android.gms.common.api.ApiException: 10:
Which says that I need to Link Google Play to Firebase https://support.google.com/firebase/answer/6392038?hl=en
But I get the following error:
Any idea how to solve this?
My app is in production but the login fails.
My solution was:
Login to Firebase console
remove your android app
add it again
follow Generate SHA-1 for Flutter app to get your release sha-1 and add it to your app in Firebase console Google sign in failed com.google.android.gms.common.api.ApiException: 10:
remarks:
I believe the actual value of the sha-1 key didn't changed
I didn't add my debug SHA1, only release
I believe simply deleting the debug SHA1 or deleting both and re-entering only the release SHA1 would have also solved the problem, but I didn't test it
I still get the Linking to Google Play: An error occurred while trying to link but I doens't matter as long as the signing works
I guess (didnt check yet) that now my app will fail on google singin indebugmode, but I will deal with it later - I hope that simply adding thedebug` key again will work
extra info (from firebase support)
Here we have two issues: Linking play console to Firebase console, and the issue with the google-sign-in on production.
For the linking problem, note that in order to link or unlink your Play Console account to a Firebase project, you need to use the same Google account on the Play Console and Firebase console. You may also check this https://support.google.com/googleplay/android-developer/answer/6110967?hl=en for more details, if the accounts are the correct try to enable Google Analytics first which then it will allow you to link your Google Play account.
For the second issue, you could have configured the debug and release SHA-1 keys. However, you need a third key hash, when you enroll for Google Play App Signing https://medium.com/mindorks/securing-and-optimizing-your-app-with-google-play-app-signing-24a3658fd319 in play console, you basically ask google to sign your app on your behalf, in order to obtain the key you must add the app signing certificate from the Play console, and add the SHA-1 key in the Firebase console. I really encourage you to read this blog entry https://medium.com/#akashmahali/facebook-login-google-sign-in-not-working-on-android-app-in-production-5febd9537f92, there the author explains more about this error, and how to fix it.
If you have any questions, feel free to write back !

Google Cloud API expired

I am working on a mobile app project with Kotlin and I implemented auth with google. Everything was fine until I recently bought a Firebase license and I restarted the google APIs which throws this error:
com.google.firebase.FirebaseException: An internal error has occurred. [API key expired. Please renew the API key. ].
I tried to generate another key and download the .json file and replace it with the old one. But it's not working.

Error 403 because Google Cloud Vision client points to wrong project

I'm trying to work through the Google Cloud Vision Pyhon example but I'm getting an authentication error.
This is not my only Google Cloud project, and my GOOGLE_APPLICATION_CREDENTIALS environment variable is set to the path to my bigquery project. I thought I could override this by using this statement:
client = vision.ImageAnnotatorClient.from_service_account_json(key_path)
where key_path is the path of the json key file associated with my (Cloud Vision API-enabled) vision project. However, I'm getting the 403 error from this
response = client.label_detection(image=image)
Apparently, even though I specified the key file path for the ImageAnnotatorClient, it still looks at my bigquery project's credentials and spits the dummy because there is no vision API enabled for it.
Do I really have to change the environment variable every time I change the project?
It seems that the Cloud Vision project ID does not propagate to the Python environment from either the Cloud Console or the credentials file. I fixed the reference using the Cloud Console:
gcloud config set project my_vision_project
The label_detection call works now.

Firebase Cloud Messaging server key not displaying at Console

My server key is not displaying at my firebase Console. What configuration should I do?
This is a known issue and is being addressed. Usually you would get into this state when the API key automatically generated by the creation of the Firebase project is deleted from the Google Developer console. The Firebase console UI currently only shows the automatically generated server API key, and nothing if that key is deleted.
You can still use any valid server API key in the corresponding Google Developer project. So go to the Google Developer console and use one of the Server API keys there or create one if it does not exist.

Resources