- Identify which service accounts the app needs before the first build
- Follow the setup order: confirm GitHub first, then create a free-tier Supabase dev project
- Distinguish client-safe keys from backend-only secrets like the Supabase service role key
Service Account Checklist
Know which external accounts are required and why each one exists.
Lesson video is on the way
While you wait, read the full text version below: complete theory, code samples and the hands-on checklist.
Lesson Goals
By the end of this lesson, you will know:
- which types of accounts are needed before the first build,
- how to set up local configuration for the first build.
Why This Lesson Exists
A production Android app rarely runs only on a local device. A good app serving multiple features usually needs to communicate with Auth Providers, Databases, Analytics Tools, Remote Config systems, Release dashboards, Payment systems, and sometimes AI APIs.
A common beginner mistake is to open every dashboard and create every possible account on day one. That creates noise, billing anxiety, and secret management risk before the app can even build. It is easy to burn money this way, especially with AI APIs.
Official Account Links
Use official pages only:
| Service | Official page | What it gives you |
|---|---|---|
| GitHub | GitHub signup, GitHub CLI | Private repo access, terminal authentication, commits, pull requests |
| Supabase | Supabase dashboard, Supabase API keys | Project URL, anon or publishable client key, backend-only service role key |
| Firebase | Firebase Console, Firebase Android setup | Android app registration, google-services.json, analytics, Remote Config |
| Google Cloud | Google Cloud Console, OAuth consent docs | OAuth consent screen, Android OAuth client, Google API credentials |
| Gemini API | Google AI Studio API key page, Gemini API key docs | AI feature API key when the current branch enables Gemini features |
| Google Play Console | Google Play Console | Release, app signing, store listing, closed testing |
If a dashboard asks for payment information, read carefully and choose free-tier settings where possible. Do not create production billing resources just because a setup wizard suggests them.
Recommended Setup Order
1. Confirm GitHub First
Check your email for the private repo invite before pulling the code down. If you have not accepted the invite, you will not be able to clone the repo. If you already accepted the invite and still hit an error, reach out to @dantech0xff on Telegram right away.
Then check terminal authentication:
gh auth status
If this step fails, go back to lesson 02 to set up GitHub CLI. You need terminal authentication to push commits and pull requests.
2. Create A Supabase Dev Project
For learning purposes, you do not need a paid Supabase plan yet. Start with a free-tier dev project.
You usually need:
| Value | Where it comes from | Android safety note |
|---|---|---|
| Project URL | Supabase project settings/API page | Client app can use it. |
| Anon or publishable key | Supabase API keys page | Client app can use it, but it still identifies your project. |
| Service role key | Supabase API keys page | Never place this key in the Android app. |
The service role key bypasses Row Level Security. Treat it as backend-only. (You will not use this key here, but you can read about it in the Supabase docs.)
3. Prepare Firebase And Google Cloud
Go back to the official account links table and you will find Firebase and Google Cloud. Follow those links to create the accounts ahead of time.
- Firebase is usually where you register the Android app and download
google-services.jsonto build the app. - Google Cloud is usually where OAuth consent and credentials are managed.
- The Android package name and SHA-1 fingerprint must match the app you test.
Security Checklist
This section is one more reminder about the security checklist before you paste any value into code.
ALWAYS run these 3 questions before pasting a value into code:
- Is this value allowed to be seen by users?
- Is this important file already ignored by Git?
- If this secret value leaks, can I rotate it?