{"id":762,"date":"2014-11-09T21:43:11","date_gmt":"2014-11-10T03:43:11","guid":{"rendered":"http:\/\/dev.iachieved.it\/iachievedit\/?p=762"},"modified":"2020-07-14T21:47:35","modified_gmt":"2020-07-15T02:47:35","slug":"using-property-lists-for-api-keys-in-swift-applications","status":"publish","type":"post","link":"https:\/\/dev.iachieved.it\/iachievedit\/using-property-lists-for-api-keys-in-swift-applications\/","title":{"rendered":"Using Property Lists for API Keys in Swift Applications"},"content":{"rendered":"

\"Xcode \"Swift<\/p>\n

You’ve written an open source application for demonstration or illustrative purposes, and your application requires REST API keys for services such as Facebook, Twitter, Wunderground, or Parse or… You get the idea. How do you submit your application to Github for others to use without exposing your own API keys? I can’t take credit for the original idea, but here’s a Swift take on technique described by Mike Lazer-Walker<\/a>.<\/p>\n

We’ll be using iOS property list<\/i> files and a Swift wrapper. The highlights here are that we are not<\/i> checking our property list into source control (Git), but our project will reference a file called ApiKeys.plist<\/code>. If you download the project from Bitbucket<\/a> and try to run you’ll get an error because the file ApiKeys.plist<\/code> is missing. This is where you create your own ApiKeys.plist<\/code> and put in your own API keys.<\/p>\n

Note:<\/b> This technique we are using here is specific to git<\/code>. If you are using a different revision control system<\/a> look up the feature for how to ignore certain files in your source tree (for example, in Subversion you would use the svn:ignore<\/code> property).<\/p>\n

The general technique is to add a .gitignore<\/code> file to the root directory of our project and add the following line:<\/p>\n

\nApiKeys.plist\n<\/pre>\n
and then, to create a ApiKeys.plist<\/code> local to your machine with something similar to the following content:<\/p>\n
[code]
\n<?xml version="1.0" encoding="UTF-8"?>
\n<!DOCTYPE plist PUBLIC "-\/\/Apple\/\/DTD PLIST 1.0\/\/EN" "http:\/\/www.apple.com\/DTDs\/PropertyList-1.0.dtd">
\n<plist version="1.0">
\n<dict>
\n\t<key>API_CLIENT_ID<\/key>
\n\t<string>MyAPIClientID<\/string>
\n        <key>API_SECRET<\/key>
\n        <string>MyAPISecret<\/string>
\n<\/dict>
\n<\/plist>
\n[\/code]<\/p>\n
Once we have that we need a clean mechanism for obtaining the values for our keys.  This is done through a utility file in Swift (we call it ApiKeys.swift<\/code> for simplicity) with the contents:<\/p>\n
\nimport Foundation\n\nfunc valueForAPIKey(named keyname:String) -> String {\n  \/\/ Credit to the original source for this technique at\n  \/\/ http:\/\/blog.lazerwalker.com\/blog\/2014\/05\/14\/handling-private-api-keys-in-open-source-ios-apps\n  let filePath = NSBundle.main().path(forResource: \"ApiKeys\", ofType: \"plist\")\n  let plist = NSDictionary(contentsOfFile:filePath!)\n  let value = plist?.object(forKey: keyname) as! String\n  return value\n}\n<\/pre>\n
The code is straightforward and meant to be called like this:<\/p>\n
\nlet clientID = valueForAPIKey(keyname:\"API_CLIENT_ID\")\n<\/pre>\n
The routine looks for the ApiKeys.plist<\/code> file in the application’s resource bundle, loads it as an NSDictionary<\/code> and then looks up the value for the given key as a String<\/code>.<\/p>\n
It should be pointed out that what this code does not do<\/i> is in any way obfuscate the contents of the plist<\/code>.  That is, your iOS binary will have the keys included in the resource bundle and could<\/i> be extracted by someone intent on getting at them.<\/p>\n
Now, let’s look at the specifics on how to use this technique in your Swift projects.<\/p>\n
Step 1.<\/b>  Add ApiKeys.plist<\/code> to your .gitignore<\/code> file<\/p>\n
This is important; failure to do so will cause Xcode to try to automatically add your plist<\/code> file to revision control.  We don’t want that.<\/p>\n
Step 2.<\/b>  Create ApiKeys.plist<\/code><\/p>\n
You can either create ApiKeys.plist<\/code> by hand or use Xcode to create it.  Just make sure that you’ve added ApiKeys.plist<\/code> to your .gitignore<\/code> file!<\/p>\n
To create ApiKeys.plist<\/code> use File – New – File<\/b> in Xcode and create a Resource<\/b> file of type Property List<\/b>.  Select Next<\/b> and name the file ApiKeys<\/code> (the plist<\/code> file type will be created automatically).  If you name it something other than what you put in your .gitignore<\/code>, it will get added to revision control, which is not what you want.<\/i>.<\/p>\n
\"createPropertyList\"<\/a><\/p>\n
Also ensure that the file is included in your application target.<\/p>\n
\"addApiKeysFile\"<\/a><\/p>\n
Now add the API keys you need for your application to your ApiKeys.plist<\/code> file.  Select the ApiKeys.plist<\/code> file in Xcode and click on the Root<\/code> dictionary line, then right-click and choose Add Row<\/b>.  Double-click on the text that says New item<\/b> and rename it to API_CLIENT_ID<\/code>.  Double-click on the Value<\/b> column and type in your actual string.  For our purposes I’ve just put MyAPIClientID<\/code>.<\/p>\n
\"SetAPICLIENTID\"<\/a><\/p>\n
Step 3.<\/b>  Create ApiKeys.swift<\/code><\/p>\n
We want a simple wrapper for obtaining our keys, so create a new file called ApiKeys.swift<\/code> and in it place the following:<\/p>\n
\nimport Foundation\n\nfunc valueForAPIKey(named keyname:String) -> String {\n  \/\/ Credit to the original source for this technique at\n  \/\/ http:\/\/blog.lazerwalker.com\/blog\/2014\/05\/14\/handling-private-api-keys-in-open-source-ios-apps\n  let filePath = NSBundle.main().path(forResource: \"ApiKeys\", ofType: \"plist\")\n  let plist = NSDictionary(contentsOfFile:filePath!)\n  let value = plist?.object(forKey: keyname) as! String\n  return value\n}\n<\/pre>\n
Step 4.<\/b>  Use the valueForAPIKey<\/code> Routine<\/p>\n
\nlet clientID = valueForAPIKey(named:\"API_CLIENT_ID\")\n<\/pre>\n
And that’s it!  Once you have your clientID<\/code> you can add it to whatever REST calls you need to (or if you are dealing with an annoying API add it as a special HTTP X-<\/code> header).<\/p>\n
Now, I will confess, it is unclear why there isn’t a more elegant way to do this in Xcode.  Although this technique is serviceable it isn’t very DRY (don’t-repeat-yourself), but then again, how many times have started a new project only to repeat the same “bootstrap” steps such as adding AFNetworking, CocoaLumberjack, and all of the other popular frameworks?  What would be handy is the ability for Xcode to obtain API keys and other confidential information from an application like Keychain and compile them in a secure manner.  Que ser\u00e1, ser\u00e1<\/i> I suppose.<\/p>\n","protected":false},"excerpt":{"rendered":"
You’ve written an open source application for demonstration or illustrative purposes, and your application requires REST API keys for services such as Facebook, Twitter, Wunderground, or Parse or… You get the idea. How do you submit your application to Github for others to use without exposing your own API keys? I can’t take credit for […]<\/p>\n","protected":false},"author":1,"featured_media":3108,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5,2],"tags":[],"class_list":["post-762","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-swift","category-xcodetips"],"_links":{"self":[{"href":"https:\/\/dev.iachieved.it\/iachievedit\/wp-json\/wp\/v2\/posts\/762"}],"collection":[{"href":"https:\/\/dev.iachieved.it\/iachievedit\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/dev.iachieved.it\/iachievedit\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/dev.iachieved.it\/iachievedit\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/dev.iachieved.it\/iachievedit\/wp-json\/wp\/v2\/comments?post=762"}],"version-history":[{"count":34,"href":"https:\/\/dev.iachieved.it\/iachievedit\/wp-json\/wp\/v2\/posts\/762\/revisions"}],"predecessor-version":[{"id":2691,"href":"https:\/\/dev.iachieved.it\/iachievedit\/wp-json\/wp\/v2\/posts\/762\/revisions\/2691"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/dev.iachieved.it\/iachievedit\/wp-json\/wp\/v2\/media\/3108"}],"wp:attachment":[{"href":"https:\/\/dev.iachieved.it\/iachievedit\/wp-json\/wp\/v2\/media?parent=762"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/dev.iachieved.it\/iachievedit\/wp-json\/wp\/v2\/categories?post=762"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/dev.iachieved.it\/iachievedit\/wp-json\/wp\/v2\/tags?post=762"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}