Ios secrets setup

Skill patrickserrano/lacquer/profiles/ios/skills/ios-secrets-setup

Go CLI + profile templates that standardize how Claude Code works across every project

Install

npx -y skills add patrickserrano/lacquer --skill ios-secrets-setup

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

1 stars1 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Use when wiring a new app-runtime service key (RevenueCat, Aptabase, …) into a project — setting up `Secrets.xcconfig`, surfacing a key through `project.yml` into `Info.plist`, and reading it at runtime. Distinct from CI/server secrets, which live in GitHub Actions secrets and never touch an xcconfig — see the project's `CLAUDE.md` Secrets section for that split.

SKILL.md

2.6 KB, as published. Nobody here has run it

iOS App-Runtime Secrets Setup

App-runtime keys (RevenueCat, Aptabase, …) live in a gitignored Secrets.xcconfig, never in source or the committed project.yml. The lacquer syncs a Secrets.xcconfig.example template into the component dir.

Copy & ignore: cp Secrets.xcconfig.example Secrets.xcconfig, fill in real values, and add Secrets.xcconfig to .gitignore. The example is committed; the real file never is. (The committed project.yml must also stay key-free.)

Wire into the build (project.yml): point the target's configs at the xcconfig and surface each key into Info.plist:

targets:
  <App>:
    configFiles:
      Debug: Secrets.xcconfig
      Release: Secrets.xcconfig
    info:
      path: App/Info.plist
      properties:
        REVENUECAT_API_KEY: $(REVENUECAT_API_KEY)
        APTABASE_APP_KEY: $(APTABASE_APP_KEY)

Read at runtime from the Info dictionary — fail loud if a required key is blank rather than shipping a broken SDK init:

enum Secrets {
    static func required(_ key: String) -> String {
        guard let v = Bundle.main.object(forInfoDictionaryKey: key) as? String,
              !v.isEmpty else {
            fatalError("Missing \(key) — copy Secrets.xcconfig.example to Secrets.xcconfig and fill it in")
        }
        return v
    }
    static var revenueCatAPIKey: String { required("REVENUECAT_API_KEY") }
    static var aptabaseAppKey: String { required("APTABASE_APP_KEY") }
}

Secrets.xcconfig values are build-time — they are baked into the binary, so treat them as obfuscated, not secret. A truly sensitive secret belongs on a server, never in the app.

RevenueCat ships two different keys — do not confuse them. The REVENUECAT_API_KEY above is the public SDK key (appl_…), safe to compile into the app. RevenueCat's REST API uses a separate secret key (sk_…) that grants full account access — it must never go in Secrets.xcconfig or the binary. That's a CI/server secret (REVENUECAT_REST_API_KEY), set via gh secret set per the project's CLAUDE.md Secrets section.

One thing to look at

What its author says it does

SKILL.md

iOS App-Runtime Secrets Setup

Keep looking