secrets-management
Installation
SKILL.md
Secrets Management for Mobile Clients
Instructions
The first rule of mobile secrets: the client cannot keep a secret. Anything embedded in your APK / IPA is extractable in minutes. Design accordingly.
1. What's Actually a Secret
| Value | Can ship in the app? |
|---|---|
OAuth client_id (public client) |
Yes |
OAuth client_secret |
No — do not use confidential clients on mobile |
| Public keys (pinning, verification) | Yes |
| Private signing keys | No |
| Firebase / Maps / Analytics API key | Yes, but restrict by bundle ID + SHA |
| Third-party SDK secret (Stripe secret key, Twilio auth token) | No, never |
| Symmetric encryption key for local data | Generate on device, wrap with Keystore |
If the vendor says "use this secret from the mobile SDK", they mean the publishable key. Their secret key belongs on your server.