I need to integrate my android app with dropbox, basically all I want is for the user to choose a file from his dropbox and give it to my app. In order to do that I'm using dropboxChooserSDK, and it requires an API key to access dropbox.
From my first instinct was to search on how to hide the key. Looking deeply into it I have noticed that there is no silver bullet to solve the problem (I should have expected as much).
On the other hand there doesn't seem like there is much harm in having my dropbox api key exposed to the world given the prupose of the key as explained in their reference documentation:
If you're building a developer tool on top of Dropbox, your developers will need their own Dropbox app keys
While we encourage developers to use our official SDKs and libraries, we know there are a lot of different approaches to building frameworks and APIs. Regardless of how an app makes use of the Dropbox Platform, we need to know what that app is so we can let users know which apps are accessing their data. For that reason, if you provide software or services that wrap the Dropbox Platform for other developers to use, those developers must still sign up for their own Dropbox app key.
But that made me think, about the question, how much effort should I put into hiding my API keys? My intuition tells me to use a back of envelope calculation to estimate the cost/benefit trade-offs individually, but I also read here that there is ongoing discussion about such problems (though I couldn't find it).
What's the general understanding regarding securing API keys?