diff --git a/.gitignore b/.gitignore
index c97d948..d03c893 100644
--- a/.gitignore
+++ b/.gitignore
@@ -92,7 +92,9 @@ Thumbs.db
 # Secrets or signing keys (add if used)
 *.keystore
 .env
-lib/keys.properties
+
+# Local OSM client ID configuration (contains secrets)
+build_keys.conf
 
 # ───────────────────────────────
 # For now - not targeting these
diff --git a/build_keys.conf.example b/build_keys.conf.example
new file mode 100644
index 0000000..5638a97
--- /dev/null
+++ b/build_keys.conf.example
@@ -0,0 +1,10 @@
+# Local OSM client ID configuration for builds
+# Copy this file to build_keys.conf and fill in your values
+# This file is gitignored to keep your keys secret
+#
+# Get your client IDs from:
+# Production: https://www.openstreetmap.org/oauth2/applications  
+# Sandbox: https://master.apis.dev.openstreetmap.org/oauth2/applications
+
+OSM_PROD_CLIENTID=your_production_client_id_here
+OSM_SANDBOX_CLIENTID=your_sandbox_client_id_here
\ No newline at end of file
diff --git a/do_builds.sh b/do_builds.sh
index 2bbcd74..f160241 100755
--- a/do_builds.sh
+++ b/do_builds.sh
@@ -4,6 +4,35 @@
 BUILD_IOS=true
 BUILD_ANDROID=true
 
+# Function to read key=value from file
+read_from_file() {
+  local key="$1"
+  local file="build_keys.conf"
+  
+  if [ ! -f "$file" ]; then
+    return 1
+  fi
+  
+  # Read key=value pairs, ignoring comments and empty lines
+  while IFS='=' read -r k v; do
+    # Skip comments and empty lines
+    if [[ "$k" =~ ^[[:space:]]*# ]] || [[ -z "$k" ]]; then
+      continue
+    fi
+    
+    # Remove leading/trailing whitespace
+    k=$(echo "$k" | xargs)
+    v=$(echo "$v" | xargs)
+    
+    if [ "$k" = "$key" ]; then
+      echo "$v"
+      return 0
+    fi
+  done < "$file"
+  
+  return 1
+}
+
 # Parse arguments
 for arg in "$@"; do
   case $arg in
@@ -18,11 +47,39 @@ for arg in "$@"; do
       echo "  --ios       Build only iOS"
       echo "  --android   Build only Android"
       echo "  (default builds both)"
+      echo ""
+      echo "OSM client IDs must be configured in build_keys.conf"
+      echo "See build_keys.conf.example for format"
       exit 1
       ;;
   esac
 done
 
+# Load client IDs from build_keys.conf
+if [ ! -f "build_keys.conf" ]; then
+  echo "Error: build_keys.conf not found"
+  echo "Copy build_keys.conf.example to build_keys.conf and fill in your OSM client IDs"
+  exit 1
+fi
+
+echo "Loading OSM client IDs from build_keys.conf..."
+OSM_PROD_CLIENTID=$(read_from_file "OSM_PROD_CLIENTID")
+OSM_SANDBOX_CLIENTID=$(read_from_file "OSM_SANDBOX_CLIENTID")
+
+# Check required keys
+if [ -z "$OSM_PROD_CLIENTID" ]; then
+  echo "Error: OSM_PROD_CLIENTID not found in build_keys.conf"
+  exit 1
+fi
+
+if [ -z "$OSM_SANDBOX_CLIENTID" ]; then
+  echo "Error: OSM_SANDBOX_CLIENTID not found in build_keys.conf"
+  exit 1
+fi
+
+# Build the dart-define arguments
+DART_DEFINE_ARGS="--dart-define=OSM_PROD_CLIENTID=$OSM_PROD_CLIENTID --dart-define=OSM_SANDBOX_CLIENTID=$OSM_SANDBOX_CLIENTID"
+
 appver=$(grep "version:" pubspec.yaml | head -1 | cut -d ':' -f 2 | tr -d ' ' | cut -d '+' -f 1)
 echo
 echo "Building app version ${appver}..."
@@ -30,7 +87,7 @@ echo
 
 if [ "$BUILD_IOS" = true ]; then
   echo "Building iOS..."
-  flutter build ios --no-codesign || exit 1
+  flutter build ios --no-codesign $DART_DEFINE_ARGS || exit 1
 
   echo "Converting .app to .ipa..."
   ./app2ipa.sh build/ios/iphoneos/Runner.app || exit 1
@@ -42,7 +99,7 @@ fi
 
 if [ "$BUILD_ANDROID" = true ]; then
   echo "Building Android..."
-  flutter build apk || exit 1
+  flutter build apk $DART_DEFINE_ARGS || exit 1
 
   echo "Moving Android files..."
   cp build/app/outputs/flutter-apk/app-release.apk "../deflock_v${appver}.apk" || exit 1
diff --git a/lib/keys.dart b/lib/keys.dart
index ad4709e..ed9a52d 100644
--- a/lib/keys.dart
+++ b/lib/keys.dart
@@ -1,36 +1,16 @@
 // OpenStreetMap OAuth client IDs for this app.
-
-import 'dart:io';
-
-String _readFromProperties(String key) {
-  final file = File('lib/keys.properties');
-  if (!file.existsSync()) return '';
-  
-  final lines = file.readAsLinesSync();
-  for (final line in lines) {
-    if (line.startsWith(key + '=')) {
-      return line.substring(key.length + 1);
-    }
-  }
-  return '';
-}
+// These must be provided via --dart-define at build time.
 
 String get kOsmProdClientId {
   const fromBuild = String.fromEnvironment('OSM_PROD_CLIENTID');
   if (fromBuild.isNotEmpty) return fromBuild;
   
-  final fromFile = _readFromProperties('OSM_PROD_CLIENTID');
-  if (fromFile.isNotEmpty) return fromFile;
-  
-  throw Exception('OSM_PROD_CLIENTID not configured');
+  throw Exception('OSM_PROD_CLIENTID not configured. Use --dart-define=OSM_PROD_CLIENTID=your_id');
 }
 
 String get kOsmSandboxClientId {
   const fromBuild = String.fromEnvironment('OSM_SANDBOX_CLIENTID');
   if (fromBuild.isNotEmpty) return fromBuild;
   
-  final fromFile = _readFromProperties('OSM_SANDBOX_CLIENTID');
-  if (fromFile.isNotEmpty) return fromFile;
-  
-  throw Exception('OSM_SANDBOX_CLIENTID not configured');
+  throw Exception('OSM_SANDBOX_CLIENTID not configured. Use --dart-define=OSM_SANDBOX_CLIENTID=your_id');
 }
\ No newline at end of file
diff --git a/lib/keys.properties.example b/lib/keys.properties.example
deleted file mode 100644
index 9c523b0..0000000
--- a/lib/keys.properties.example
+++ /dev/null
@@ -1,10 +0,0 @@
-# OpenStreetMap OAuth Client IDs
-# Copy this file to keys.properties and fill in your values for local development
-# These are used as fallback when environment variables are not provided via --dart-define.
-# 
-# Get your client IDs from:
-# Production: https://www.openstreetmap.org/oauth2/applications
-# Sandbox: https://master.apis.dev.openstreetmap.org/oauth2/applications
-
-OSM_PROD_CLIENTID=your_production_client_id_here
-OSM_SANDBOX_CLIENTID=your_sandbox_client_id_here
\ No newline at end of file