Keep API keys and endpoints out of your app binary.
Store runtime values per app and environment, and read them through the SDK. Change them in the dashboard and your apps pick them up on the next fetch, without a new release.
Smart Grow| Name | Key | Value | Status |
|---|---|---|---|
| API base URL | API_BASE_URL | •••••••••• | Active |
| Payments key | PAYMENTS_PUBLIC_KEY | •••••••••• | Active |
| Maps key | MAPS_API_KEY | •••••••••• | Active |
| Legacy endpoint | LEGACY_API_URL | •••••••••• | Inactive |
Three steps, then change values whenever you need.
No values in the repository, no rebuild to rotate a key.
- 01
Add your values
Create variables for each app and environment in the dashboard.
- 02
Initialize the SDK
Pass the app ID, environment ID and API token when your app starts.
- 03
Read them at runtime
The SDK caches values on the device and downloads them again only when they change on the server.
A few lines in your app.
SDKs for Android, iOS, macOS, tvOS and Flutter. Use getAllSecureData to load variables and certificates in one call.
val smartGrow = SmartGrowSecure.init(
appId = "your-app-id",
environmentId = "your-environment-id",
apiToken = "your-api-token",
serverBaseUrl = "https://smartgrow.your-company.com",
context = applicationContext,
)
val apiBaseUrl = smartGrow.getVariables()
.first { it.key == "API_BASE_URL" }.valueimport Smart_Grow_Secure
let smartGrow = SmartGrowSecure.initialize(
appId: "your-app-id",
environmentId: "your-environment-id",
apiToken: "your-api-token",
serverBaseUrl: "https://smartgrow.your-company.com"
)
let apiBaseUrl = try await smartGrow.getVariables()
.first { $0.key == "API_BASE_URL" }?.valueimport 'package:smart_grow_secure_plugin/smart_grow_secure.dart';
final smartGrow = SmartGrowSecure(
appId: 'your-app-id',
environmentId: 'your-environment-id',
apiToken: 'your-api-token',
serverBaseUrl: 'https://smartgrow.your-company.com',
);
await smartGrow.initializeSmartGrowSecure();
final variables = await smartGrow.getVariables();
final apiBaseUrl = variables.firstWhere((v) => v.key == 'API_BASE_URL').value;What you get.
Every item here is something the product does today.
-
Per app and environment
Development, QA and production each keep their own values.
-
Only your signed app
Requests need the API token and your app's signing fingerprint.
-
Encrypted at rest and in transit
Stored encrypted, and delivered over a post-quantum channel on top of HTTPS.
-
Secure cache on the device
Values live in the Keychain or the Android Keystore between fetches.
-
Roles and audit log
Limit who can read or change values, and see every change.
-
Active or inactive
Disable a value without deleting it.