- Identify which service accounts you need now and which can wait, for both Android and iOS
- Follow the setup order: confirm GitHub first, then create a free-tier Supabase dev project
- Tell values that may live in the app apart from backend-only secrets such as the Supabase service role key
Service Account Checklist
Know which outside accounts you need and why you need each one.
Lesson video is on the way
While you wait, read the full text version below: complete theory, code samples and the hands-on checklist.
Lesson Goal
By the end of this lesson you will know:
- Which accounts you need before the first build, and which can wait,
- A safe order to set them up in,
- Which values may live inside the app, and which never can.
Why This Lesson Exists
A production mobile app rarely runs on the device alone. It talks to an auth provider, a database, analytics, Remote Config, release dashboards, a payment system and sometimes an AI API. The course app runs on both Android and iOS, so some services have separate configuration for each platform.
Beginners often open every dashboard and create every account on day one. That tends to cause billing worries and a risk of leaking secrets before the app even builds. AI APIs are where it's easiest to spend money.
Official Account Links
Use official pages only:
| Service | Official page | What it provides | When you need it |
|---|---|---|---|
| GitHub | Create a GitHub account, GitHub CLI | Private repo access, terminal authentication, commits, pull requests | Now |
| Supabase | Supabase dashboard, Supabase API keys | Project URL, publishable key (sb_publishable_...), backend-only secret key or service role key | Now |
| Firebase | Firebase Console, Firebase Android setup | Android app registration, google-services.json, Analytics, Remote Config | Before the first build |
| Google Cloud | Google Cloud Console, OAuth consent docs | OAuth consent screen, OAuth clients for Google Sign-In | When you work on Google Sign-In |
| Gemini API | Google AI Studio API key page, Gemini API key docs | API key for the AI hint (on Android, the app reads the key through Firebase Remote Config) | When you work on the AI hint |
| RevenueCat | RevenueCat, RevenueCat API keys | Public SDK key for subscriptions and the paywall | When you work on premium |
| Apple Developer | Apple Developer Program | Signing apps for real iPhones, TestFlight, App Store | When you ship iOS |
| Google Play Console | Google Play Console | Releases, app signing, store listing, closed testing | When you ship Android |
The premium gate is off by default (premium.gate.enabled is false when not set), so the app runs without RevenueCat. Running the app on the iOS Simulator doesn't need the Apple Developer Program either.
If a dashboard asks for payment information, read carefully and pick the free tier when you can. Don't create production billing resources just because a setup wizard suggests it.
Recommended Setup Order
1. Confirm GitHub First
Check your email for the private repo invite before you pull any code. Until you accept the invite you can't clone the repo. If you have accepted it and still get an error, contact @dantech0xff on Telegram.
Then check terminal authentication:
gh auth status
If this fails, install GitHub CLI and run gh auth login first.
2. Create A Supabase Dev Project
For learning, a free-tier dev project is enough.
| Value | Where to get it | Safety note |
|---|---|---|
| Project URL | The Connect button on the project page | Safe for the client app. |
| Publishable key | Supabase API keys page | Safe for the client app, but it still identifies your project. |
| Service role key | Supabase API keys page | Never put this key in the Android or iOS app. |
The service role key bypasses Row Level Security, so it belongs on a backend only. The course app never uses it.
3. Prepare Firebase And Google Cloud
- Firebase is where you register the Android app and download
google-services.json. - Google Cloud is where you manage OAuth consent and OAuth clients. Android uses a web client ID (
google.server.clientId). iOS needs its own iOS OAuth client as well, but only if you run the iOS build on a Mac. - The Android package name and SHA-1 fingerprint must match the app you test. The iOS bundle ID must match the iOS OAuth client.
Security Checklist
Before you paste any value into the project, answer three questions:
- Is this value allowed to live in the app, where a user could read it?
- Is the file that holds it ignored by Git?
- If it leaks, can I rotate it?
Anything packaged into the app (Android or iOS) can be read back out. The Supabase publishable key, OAuth client IDs and the RevenueCat public key are designed to live in the app. The Supabase secret key (sb_secret_...), the service role key, database passwords and keystore passwords are not.