How to Secure Your Gemini API Key in Flutter (Edge Function Proxy)
Your Gemini API key ships inside your Flutter app binary — anyone can extract it. Learn the production proxy pattern: keep the key in a Supabase Edge Function and call it from Flutter.
If your Flutter app calls the Gemini API directly, your API key ships inside the app binary. Anyone can extract it — and then burn through your quota on your bill. This guide shows the production pattern that fixes it: keep the key on the server in a Supabase Edge Function, and let your app call the function instead of Gemini. The app never sees the key. Every snippet below is written against supabase_flutter v2 (stable) and Dart 3.13 . The Dart client code was type-checked against the real supabase Dart package (v2.16.2). The Edge Function follows the official Supabase Edge Functions pattern — deploy it to your own project and test before shipping (commands in Step 2). 🎬 Watch: Your Flutter API Keys Are NOT Safe (Here's the Fix) The Flutter Way demonstrates exactly why API keys leak from Flutter apps — and the backend-proxy fix this guide implements. Why your API key is already public A compiled Flutter app is not a vault. All of these expose a hardcoded or --dart-define key within minutes: APK decompilation — strings in the binary are trivially readable. Proxy inspection — anyone running the app through a MITM proxy sees the key in the request. Quota theft — with your key, anyone can call the Gemini API as you. You pay. Google's own guidance is blunt: API keys embedded in client apps should be treated as public. The fix isn't hiding the key better in the client — it's not putting it in the client at all . The three "fixes" that don't actually work 1. Hardcoding it in Dart code. Visible in the binary. Zero protection. 2. .env file with flutter_dotenv. Keeps the key out of git, which is good hygiene — but the value is still bundled into the app at build time. It protects your repository, not your key. 3. --dart-define build flags. Same story: the value is compiled into…