This it the right way to do client IDs / secrets and local builds

.github/workflows/workflow.yml

@@ -47,9 +47,6 @@ jobs:
         with:
           channel: 'stable'
 
-      - name: Create keys.dart from example
-        run: cp lib/keys.dart.example lib/keys.dart
-
       - name: Install dependencies
         run: flutter pub get
 
@@ -70,7 +67,7 @@ jobs:
           echo "storeFile=keystore.jks" >> android/key.properties
 
       - name: Build Android .apk
-        run: flutter build apk --release
+        run: flutter build apk --release --dart-define=OSM_PROD_CLIENTID='${{ secrets.OSM_PROD_CLIENTID }}' --dart-define=OSM_SANDBOX_CLIENTID='${{ secrets.OSM_SANDBOX_CLIENTID }}'
 
       - name: Upload .apk artifact
         uses: actions/upload-artifact@v4
@@ -99,9 +96,6 @@ jobs:
         with:
           channel: 'stable'
 
-      - name: Create keys.dart from example
-        run: cp lib/keys.dart.example lib/keys.dart
-
       - name: Install dependencies
         run: flutter pub get
 
@@ -122,7 +116,7 @@ jobs:
           echo "storeFile=keystore.jks" >> android/key.properties
 
       - name: Build Android appBundle
-        run: flutter build appbundle
+        run: flutter build appbundle --dart-define=OSM_PROD_CLIENTID='${{ secrets.OSM_PROD_CLIENTID }}' --dart-define=OSM_SANDBOX_CLIENTID='${{ secrets.OSM_SANDBOX_CLIENTID }}'
 
       - name: Upload .aab artifact
         uses: actions/upload-artifact@v4
@@ -144,9 +138,6 @@ jobs:
         with:
           channel: 'stable'
 
-      - name: Create keys.dart from example
-        run: cp lib/keys.dart.example lib/keys.dart
-
       - name: Install dependencies
         run: flutter pub get
 
@@ -160,7 +151,7 @@ jobs:
 
       - name: Build iOS .app
         run: |
-          flutter build ios --release --no-codesign
+          flutter build ios --release --no-codesign --dart-define=OSM_PROD_CLIENTID='${{ secrets.OSM_PROD_CLIENTID }}' --dart-define=OSM_SANDBOX_CLIENTID='${{ secrets.OSM_SANDBOX_CLIENTID }}'
           ./app2ipa.sh build/ios/iphoneos/Runner.app
 
       - name: Upload IPA artifact

.gitignore

@@ -92,7 +92,7 @@ Thumbs.db
 # Secrets or signing keys (add if used)
 *.keystore
 .env
-lib/keys.dart
+lib/keys.properties
 
 # ───────────────────────────────
 # For now - not targeting these

lib/keys.dart

@@ -0,0 +1,36 @@
+// OpenStreetMap OAuth client IDs for this app.
+
+import 'dart:io';
+
+String _readFromProperties(String key) {
+  final file = File('lib/keys.properties');
+  if (!file.existsSync()) return '';
+  
+  final lines = file.readAsLinesSync();
+  for (final line in lines) {
+    if (line.startsWith(key + '=')) {
+      return line.substring(key.length + 1);
+    }
+  }
+  return '';
+}
+
+String get kOsmProdClientId {
+  const fromBuild = String.fromEnvironment('OSM_PROD_CLIENTID');
+  if (fromBuild.isNotEmpty) return fromBuild;
+  
+  final fromFile = _readFromProperties('OSM_PROD_CLIENTID');
+  if (fromFile.isNotEmpty) return fromFile;
+  
+  throw Exception('OSM_PROD_CLIENTID not configured');
+}
+
+String get kOsmSandboxClientId {
+  const fromBuild = String.fromEnvironment('OSM_SANDBOX_CLIENTID');
+  if (fromBuild.isNotEmpty) return fromBuild;
+  
+  final fromFile = _readFromProperties('OSM_SANDBOX_CLIENTID');
+  if (fromFile.isNotEmpty) return fromFile;
+  
+  throw Exception('OSM_SANDBOX_CLIENTID not configured');
+}

lib/keys.dart.example

@@ -1,33 +0,0 @@
-// OpenStreetMap OAuth client IDs for this app.
-//
-// NEVER commit keys.dart to public repos. For open source, use keys.dart.example instead.
-
-import 'dart:io';
-
-// Fallback client IDs for local development - replace with your own if building locally
-const String _kOsmProdClientIdFallback = ''; // Put your fallback production client ID here
-const String _kOsmSandboxClientIdFallback = ''; // Put your fallback sandbox client ID here
-
-// Get client IDs from environment variables first, then fallback to constants
-String get kOsmProdClientId {
-  final envValue = Platform.environment['OSM_PROD_CLIENTID'];
-  if (envValue != null && envValue.isNotEmpty) {
-    return envValue;
-  }
-  if (_kOsmProdClientIdFallback.isNotEmpty) {
-    return _kOsmProdClientIdFallback;
-  }
-  throw Exception('OSM Production Client ID not configured. Set OSM_PROD_CLIENTID environment variable or configure fallback in keys.dart');
-}
-
-String get kOsmSandboxClientId {
-  final envValue = Platform.environment['OSM_SANDBOX_CLIENTID'];
-  if (envValue != null && envValue.isNotEmpty) {
-    return envValue;
-  }
-  if (_kOsmSandboxClientIdFallback.isNotEmpty) {
-    return _kOsmSandboxClientIdFallback;
-  }
-  throw Exception('OSM Sandbox Client ID not configured. Set OSM_SANDBOX_CLIENTID environment variable or configure fallback in keys.dart');
-}
-

lib/keys.properties.example

@@ -0,0 +1,10 @@
+# OpenStreetMap OAuth Client IDs
+# Copy this file to keys.properties and fill in your values for local development
+# These are used as fallback when environment variables are not provided via --dart-define.
+# 
+# Get your client IDs from:
+# Production: https://www.openstreetmap.org/oauth2/applications
+# Sandbox: https://master.apis.dev.openstreetmap.org/oauth2/applications
+
+OSM_PROD_CLIENTID=your_production_client_id_here
+OSM_SANDBOX_CLIENTID=your_sandbox_client_id_here

pubspec.yaml

@@ -1,7 +1,7 @@
 name: deflockapp
 description: Map public surveillance infrastructure with OpenStreetMap
 publish_to: "none"
-version: 1.2.1+3   # The thing after the + is the google versionCode
+version: 1.2.2+3   # The thing after the + is the google versionCode
 
 environment:
   sdk: ">=3.5.0 <4.0.0"   # oauth2_client 4.x needs Dart 3.5+