Android Here Maps API密钥程序化设置及凭证存储方案咨询

Hey there! Let's tackle your HERE Maps SDK credential issue step by step—this is a common concern with static code analysis tools, so you're not alone. We'll cover both secure storage options and how to configure the SDK programmatically instead of relying on the manifest.

Storing credentials directly in build.gradle isn't ideal because that file often gets committed to version control, triggering those "hardcoded key" warnings. Here are better alternatives:

1. Use a local.properties file #

This file is designed for local environment-specific config and shouldn't be committed to your repo (make sure it's added to .gitignore).

• Add your credentials to local.properties at the root of your project:

  HERE_MAP_APP_ID=your_actual_app_id
  HERE_MAP_APP_TOKEN=your_actual_app_token
  HERE_MAP_LICENSE_KEY=your_actual_license_key
  

• Then, in your app module's build.gradle, read these values and pass them as manifest placeholders:

  def localProperties = new Properties()
  localProperties.load(new FileInputStream(rootProject.file("local.properties")))
  
  android {
      defaultConfig {
          manifestPlaceholders = [
              here_map_app_id: localProperties.getProperty("HERE_MAP_APP_ID"),
              here_map_app_code: localProperties.getProperty("HERE_MAP_APP_TOKEN"),
              here_map_licence_key: localProperties.getProperty("HERE_MAP_LICENSE_KEY")
          ]
      }
  }
  

This keeps credentials out of your version history while still using the manifest approach you're familiar with.

2. Use Environment Variables #

For CI/CD pipelines or team-wide setups, storing credentials as system environment variables is a great fit.

• Set the variables on your local machine or CI server (e.g., export HERE_MAP_APP_ID=your_id on Linux/macOS, or via system settings on Windows).
• Update your app's build.gradle to pull these values:

  android {
      defaultConfig {
          manifestPlaceholders = [
              here_map_app_id: System.getenv("HERE_MAP_APP_ID"),
              here_map_app_code: System.getenv("HERE_MAP_APP_TOKEN"),
              here_map_licence_key: System.getenv("HERE_MAP_LICENSE_KEY")
          ]
      }
  }
  

Good news: YES, you can configure the SDK programmatically instead of using the manifest. This is especially useful if you want to fetch credentials from your backend dynamically.

How to do it: #

You need to set the credentials before initializing any map components (like MapFragment or MapView). A good place to do this is in your Application class or early in your Activity's onCreate() method.

Example code (Java):

import com.here.android.mpa.common.MapEngine;
import com.here.android.mpa.common.MapSettings;
import com.here.android.mpa.common.OnEngineInitListener;

// In your Application class or Activity
@Override
public void onCreate() {
    super.onCreate();
    
    // Fetch credentials from backend here (if needed)
    // String appId = fetchCredentialsFromBackend();
    // String appToken = fetchCredentialsFromBackend();
    // String licenseKey = fetchCredentialsFromBackend();
    
    // Set credentials programmatically
    try {
        MapSettings.setAppId("your_app_id");
        MapSettings.setAppToken("your_app_token");
        MapSettings.setLicenseKey("your_license_key");
        
        // Initialize the map engine
        MapEngine.getInstance().init(this, new OnEngineInitListener() {
            @Override
            public void onEngineInitializationCompleted(OnEngineInitListener.Error error) {
                if (error == OnEngineInitListener.Error.NONE) {
                    // Map engine is ready—proceed to set up your map
                } else {
                    // Handle initialization failure (log error, show user message)
                }
            }
        });
    } catch (Exception e) {
        e.printStackTrace();
    }
}

Key Notes: #

• If you use both manifest meta-data tags and programmatic configuration, the programmatic settings will override the manifest entries. You can safely remove the meta-data tags once you switch to programmatic setup.
• If fetching from a backend, make sure the network call completes before initializing the map engine to avoid errors. You might want to show a loading state while waiting for the credentials.

内容的提问来源于stack exchange，提问作者bkaancelen