Android Question API Key in file on its own instead of manifest?

1. The key should be restricted to a specific package with a specific signature. Assuming that only you have access to the signing key, it will make the API key practically safe.

2. I think that the above point is suffice, however you can move the relevant snippet to a text file, put it inside a zip file, change the zip file to jar, copy to additional libs folder, and then add it with:

See Themes.jar in the internal libraries folder for an example.