Android Question Google OAuth2 protect ClientID

[energypf]

Hello, I have implemented synchronization with Google Drive in my App using the various classes on the forum. Everything works well, but now having to distribute my App I wanted to know if I had to apply some corrections to the GoogleOAuth2 module that managed the authentication to Google, specifically the saving within the app of the ClientID released by google for use. of the API. My question, however, is not only about where to save this value, but about the fact that even saving it externally, when my App opens the browser to authenticate with Google, the ClientID is present in the URL of the call. So does it make sense to blur it?
Thanks in advance

Private Sub Authenticate
    Log("GoogleOAuth2.Authenticate")
    Dim link As String = BuildLink("https://accounts.google.com/o/oauth2/v2/auth", _
         CreateMap("client_id": mClientId, _
        "redirect_uri": GetRedirectUri, _
        "response_type": "code", "scope": mScope))
    Dim pi As PhoneIntents
    StartActivity(pi.OpenBrowser(link))
End Sub

 

[Erel]

So does it make sense to blur it?

Not really.

The client id is tied to a specific package name and signing key. Hackers can do very little with it.
It is expected to be saved inside the app which means that hackers can extract it with some work.

 

[energypf]

Then use the obfuscation of B4X enough? Or is it better to do something else?

 

[Erel]

Then use the obfuscation of B4X enough?

Yes.

Make sure that the "credential record" in Google API console is limited to your package name.

 

[energypf]

Yes.

Make sure that the "credential record" in Google API console is limited to your package name.

Yes yes, they are limited to my app only.