Hi, reaching out here, as I assume and hope that this community is the one that has the better knowledge on the use of API keys.

I’m currently investigating a couple of free VPNs, e.g. APKs, for my thesis. I’ve stumbled upon many of these VPNs leaving API keys, auth key etc… hardcoded into the app. However, one API key in particular is the one used by android.gms.internal.ads. This key is present in multiple different apps, not just VPN apps, but other complete random apps. Now, I am no programmer, and that’s why I’m asking for some pointers to get a better understanding of this. How come this API-key, belonging to a Google Service, is present in so many different apps? I’ve tried to look it up, and found another malware report from 2021, that highlight finding the same API-key.

The API Key is: AIzaSyDRKQ9d6kfsoZT2lUnZcZnBYvH69HExNPE

Code example key being found in;

public final class zzadt {
    private static zzacy<String> zzdfw = zzacy.zzh("gads:safe_browsing:api_key", "
AIzaSyDRKQ9d6kfsoZT2lUnZcZnBYvH69HExNPE
");

Is there a good reason for this API key being reused so many times? Appreciate any pointers or help!