This is a problem I've regularly faced with it android apps . Possible solutions since many people seem to be asking that.

- Fetch credentials and keys on login and then save them in an encrypted manner in

- SQLite Encrypted DB

- Android Services like KeyStore[1]

- AccountManager lets you save metadata[2]

But the way I mostly end up using which provides protection from a lot of Reverse Engineering Tools(JADX,dex2jar,smali) is:

Use Enums instead of String constants. Using

``` public enum Key {

     Key1("keyValue");
 
     String keyVal;
 
     private Key(String keyVal) {
         this.keyVal = keyVal;
     }
 }

``` obfuscates the `keyVal` from many class decompilers.

I'd love better ways to do this. But when you do Android development (like when you do Front End web dev), its easier to just assume that everything you wish to keep private will be visible and avoid keeping/saving critical information on the client app.

[1]:https://developer.android.com/training/articles/keystore.htm...

[2]:https://developer.android.com/reference/android/accounts/Acc..., java.lang.String)