[chr7z]

There is a tool for moving API keys out of the source: Keystok stores encrypted API keys and tokes in a cloud service and lets the App / client retrieve them during runtime.

Its not just about moving keys out of the source, but about getting rid of local config files altogether. Related post on their blog: http://blog.keystok.com/why-i-stopped-using-local-config-fil...

Disclosure: I'm a developer at Keystok.

[kuschku]

And a developer with Apktool could still modify the app and get the keys, you win nothing with this solution.

[lucian1900]

That is much worse, though: you're actively disclosing your API keys to a third party (keystok).