You're right, I've fuzzed those out but anyone can still pull it out of the app. Seems like a bad idea to have those hardcoded client-side, so I'm not sure why Google requires developers to do this.

Edit: actually I think the value that is exposed is the token ID, not the token itself. I haven't used Google Cloud Manager before myself, so maybe someone can confirm.