0

I'm quiet new to firebase and I've read up that it's okay to expose the API Keys and that the security rules should be configured in firebase. Would it make sense not to want to expose the API keys publicly and to want to store them in an env file instead ?

I've tried this approach where I store API_KEY, AUTH_DOMAIN, DATABASE_URL etc... in an env file.
Install dotenv package and import them the keys into firebase.js where I have:

import { API_KEY, AUTH_DOMAIN, DATABASE_URL, PROJECT_ID, STORAGE_BUCKET, MESSAGING_SENDER_ID, APP_ID, MEASUREMENT_ID } from "@env";

const config = {
  apiKey: API_KEY,
  authDomain: AUTH_DOMAIN,
  databaseURL: DATABASE_URL,
  projectId: PROJECT_ID,
  storageBucket: STORAGE_BUCKET,
  messagingSenderId: MESSAGING_SENDER_ID,
  appId: APP_ID,
  measurementId: MEASUREMENT_ID,
};

It works great locally when I try to start up the emulator, however when I push the project to github, I'm very well aware that in gitignore we must include .env, the problem is when I push the project to github and then try to execute a build for an android APK using expo "eas build --platform android", it cannot find the .env since it was not uploaded to github.

what are some ways I can inject the env into build ?

In app.config.js, I have tried the following but it's not useful for build

require("dotenv").config();

export default {
  expo: {
 ...
extra: {
      apiKey: process.env.API_KEY,
      authDomain: process.env.AUTH_DOMAIN,
      databaseURL: process.env.DATABASE_URL,
      projectId: process.env.PROJECT_ID,
      storageBucket: process.env.STORAGE_BUCKET,
      messagingSenderId: process.env.MESSAGING_SENDER_ID,
      appId: process.env.APP_ID,
      measurementId: process.env.MEASUREMENT_ID,
  }
}
Frank van Puffelen
  • 565,676
  • 79
  • 828
  • 807
Max
  • 19
  • 1
  • 5

1 Answers1

0

You can try solutions mentioned here:

  • using .easignore file which basically is a copy of your .gitignore file excluding .env file.
  • utilising EAS secrets
Aliaksei
  • 1,094
  • 11
  • 20