API keys and secrets used in iOS app - where to store them?

Question

I'm developing for iOS and I need to make requests to certain APIs using an API key and a secret. However, I wouldn't like for it to be exposed in my source code and have the secret compromised when I push to my repository.

What is the best practice for this case? Write it in a separate file which I'll include in .gitignore?

Thanks

Answer 1

Write it in a separate file which I'll include in .gitignore?

No, don't write it ever.
That means:

• you don't write that secret within your repo (no need to gitignore it, or ot worry about adding/committing/pushing it by mistake)
• you don't write it anywhere on your local drive (no need to worry about your computer stolen with that "secret" on it)

Store in your repo a script able to seek that secret from an external source (from outside of git repo) and load it in memory.
This is similar to a git credential-helper process, and that script would launch a process listening to localhost:port in order to serve that "secret" to you when you whenever you need it in the current session only.
Once the session is done, there is no trace left.
And that is the best practice to manage secret data.

You can trigger automatically that script on git checkout, if you declare it in a .gitattributes file as a content filter:

Answer 2

This is a very old question, but if anyone is seeing this in google I would suggest you try CloudKit for storing any App secrets (API keys, Oauth secrets). Only your app can access your app container and communication between Apple and your app is secure. You can check it out here.