Where to store API keys on Swift?
There are many tools to store secret keys.
- https://nshipster.com/secrets/
- https://www.freecodecamp.org/news/how-to-securely-store-api-keys-4ff3ea19ebda/
If personal project, I typically go with xccconfig and just ignore that file in git but with teams this can be quite hard.
First of all you need to keep in mind that every piece of code that you deliver with you app will be possible to obtain by the attacker. Any kind of obfuscation won't protect it and only make the attack more expensive and time consuming.
Therefore you shouldn't keep any sensitive keys or secrets in the source code. You need to think of server side solution for storing secrets. The server side solution would stand between your app and the API that you are actually gonna call.
In the case of Stripe, it doesn't matter so much as Stripe was designed with this in mind, so much so they take financial responsibility with PCI compliance. They have more complex methods of authenticating a user and limiting access.