Start with the uncomfortable part, because everything else follows from it. Any string compiled into your app is public. Not “hard to find” — public. An APK is a zip file; strings on the extracted binary takes seconds. --dart-define values, constants, obfuscated names, base64-encoded blobs: all of it is recoverable by anyone motivated enough to download your app once. This is not a Flutter weakness. It is true of every client application on every platform. What it changes is where you draw the line between “the app knows this” and “the app can ask for this”. The line Kind of secret Where it belongs Third-party API key with billing attached Server only. The app calls your backend, your backend calls them Public/publishable keys (Stripe publishable, Firebase config, Maps key) In the app — they are designed for it, and restricted server-side User session token Device secure storage, short-lived, refreshable Refresh token Device secure storage, revoc...