The GA4 Measurement Protocol key

[criticalAY]

Context

The GA4 Measurement Protocol api_secret is currently sourced from local.properties (ANALYTICS_API_KEY) or the ANALYTICS_API_KEY env var, with a DUMMY_API_XXX fallback so contributor builds compile.

Question raised by @david-allison

Only an issue with the build.gradle change, and that's mostly my ignorance/wanting reassurance.

I believe in our prior implementation, the key wasn't obscured. Obscuring a publicly-facing analytics key is
semi-understandable from the perspective of not wanting malicious clients, but it's unusual to me, as it's not a > private key.

(For example, with Firebase, this would be a public credential on a website)

If you'd be OK with deferring the conversation, shift it to an issue and merge at will!
cc @mikehardy

TODO

• Research how other OSS Android projects handle GA4 Measurement Protocol api_secret (Signal, K-9 Mail, F-Droid clients, etc.)
• Decide: keep obscuring, publish the key, or stand up a separate dev GA4 property
• Document the decision in the analytics package KDoc

[github-actions]

Hello 👋, this issue has been opened for more than 3 months with no activity on it. If the issue is still here, please keep in mind that we need community support and help to fix it! Just comment something like still searching for solutions and if you found one, please open a pull request! You have 7 days until this gets closed automatically