Skip to content

Update Library Values to clarify usage #422

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 4 commits into from
Jul 11, 2025
Merged
Show file tree
Hide file tree
Changes from 1 commit
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 5 additions & 5 deletions docs/ff-concepts/adding-customization/configuration-files.md
Original file line number Diff line number Diff line change
Expand Up @@ -254,19 +254,19 @@ If `ALLOW_HTTP_TRAFFIC` is set to `true` in FlutterFlow’s Environment Value, t

**Example 3: Using Library Values**

If you are building a [FlutterFlow Library](../../resources/projects/libraries.md) and need to include API keys in native code without exposing them when users import the library, you can use [Library Values](../../resources/projects/libraries.md#library-values) as placeholders. This ensures that when someone installs your library, they can define their own values without seeing the actual key or credentials inside the native files.
If you are building a [FlutterFlow Library](../../resources/projects/libraries.md) and need to include public API keys in native code, you can use [Library Values](../../resources/projects/libraries.md#library-values) as placeholders. This ensures that when someone installs your library, they can define their own values.

For example, if your library requires an API key for a third-party service (e.g., Google Maps or a payment provider), it’s best not to expose the key directly in the manifest file. Instead, create a file-level variable and assign it a Library Value.
For example, if your library integrates with a public weather API that requires an API key (such as Open-Meteo or WeatherAPI for general use), it’s best not to add the key directly in the manifest file. Instead, create a file-level variable and assign it a Library Value.

```
```jsx
<application>
<meta-data
android:name="com.google.android.geo.API_KEY"
android:value="{{MAPS_API_KEY}}" />
android:value="{{WEATHER_API_KEY}}" />
</application>
```

The library user will define their own API key under Library Values when importing your library. At build time, FlutterFlow replaces `{{MAPS_API_KEY}}` with the user-defined key.
The library user will define their own API key under Library Values when importing your library. At build time, FlutterFlow replaces `{{WEATHER_API_KEY}}` with the user-defined key.

## Editable Files

Expand Down
11 changes: 8 additions & 3 deletions docs/resources/projects/libraries.md
Original file line number Diff line number Diff line change
Expand Up @@ -295,11 +295,16 @@ The library author selects which pages to include and publishes the library. Whe

## Library Values

**Library values** are essentially variables created and used by a library author and intended to have their values set by the library user. These values allow library author to create configurable variables that are useful in different contexts, such as API keys, global settings, or other project-specific configurations. These values allow library users to input specific data required for the library to function properly in their project.
**Library values** are essentially variables created and used by a library author and intended to have their values set by the library user. These values allow library author to create configurable variables that are useful in different contexts, such as public API keys, global settings, or other project-specific configurations. These values allow library users to input specific data required for the library to function properly in their project.

For example, If someone has built a library that uses OpenAI API, they would define a Library Value for the OpenAI API key. As the user of the library, when you import, you must provide your own API key to ensure the library functions properly.
For example, if someone builds a library with a paginated list or a tabbed interface, they can define Library Values for display settings like `Items per page: 10` or `Initial tab index: 0`. This allows the library user to easily customize the UI behavior to fit their project’s needs without modifying the library’s internal logic.
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can we do a better example maybe? for example if user is building a payment gateway library then the amount & currency (and user id etc) can be passed down to the library from the main project so the payment gateway can initiate a payment for that amount.

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done!


:::danger
**Library Values should not be used to store private or sensitive data**, such as secret API keys or credentials. These values are not currently designed to securely store or handle sensitive information.

The use of *public API key* is generally acceptable, because the keys often have limited permissions, rate limits, or are intended for public use. For instance, if someone creates a library that connects to a public weather API, they might define a Library Value for the API key. Users of that library can then input their own API key to make it work.
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

there are various names for it and we should mention them for SEO such as client-side API keys or Supabase like tools calls it publishable keys etc.

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

also link to our docs for "restrict api keys" where I mention about how to restrict google cloud api keys when using on the client side. maybe you can give an example that even if you use maps key in a library, you must restrict the key permissions and link to docs

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done!

:::

By using Library Values, the library author allows users to adapt the library to their own configurations without hardcoding sensitive or project-specific data, like API keys, into the library itself.

### Create Library Values as Author

Expand Down