Manage Secrets & API Keys

Background: Native [platform] app. The app uses these secrets/keys: [API
keys, client secrets, third-party tokens]. Right now they're [hardcoded /
in a config file / unknown].

Use case: Handle these secrets correctly, with a realistic understanding
that anything shipped in the binary can be extracted.

Implementation details:
- The hard truth: client-side secrets are not truly secret—plan
  accordingly. What genuinely must stay private belongs server-side
  behind your backend, not in the app.
- Keep keys out of source control (no committed secrets); inject at build
  time (xcconfig / Gradle properties / CI secrets), not checked-in files
- Use restricted/scoped keys (referrer/bundle-id restricted, least
  privilege) so a leaked client key is low-impact
- For high-value operations, proxy through your backend instead of
  calling third parties directly from the app
- Obfuscation as speed-bump only, never as the security boundary

Deliverable: A classification of which secrets can live client-side
(restricted) vs must move server-side, the build-time injection setup,
the source-control hygiene, and the proxy approach for the
must-stay-secret operations.