docs(sdks): Kotlin SDK Android example ships a secret API key in the app binary

[aagarwal1012]

Split out of #449 review feedback (item 6), which correctly scoped it out of that PR.

Problem

developer-resources/sdks/kotlin.mdx → ## Android Integration (~line 348) builds a server client inside an Android ViewModel:

class PaymentViewModel(application: Application) : ViewModel() {
    private val client = DodoPaymentsOkHttpClient.builder()
        .bearerToken(BuildConfig.DODO_API_KEY)
        .build()

    fun createCheckout(productId: String) {
        viewModelScope.launch {
            val session = client.async().checkoutSessions().create(params)
            openUrl(session.checkoutUrl())
        }
    }
}

BuildConfig constants are compiled into the APK as plain string literals and are trivially recoverable with apktool or strings. This example therefore ships a secret API key to every user, and creates checkout sessions client-side.

Why it matters more now

#449 added developer-resources/sdks/android.mdx, which states "never ship an API key in your app — create checkout sessions on your backend." That page links to sdks/kotlin.mdx to disambiguate the backend SDK from the checkout SDK, so readers now get routed from correct guidance straight into contradictory guidance.

The rest of the docs are consistent on this. mobile-integration.mdx has always said mobile apps should only talk to your backend, and the four mobile checkout SDKs hold no API key by design.

Suggested fix

Replace the ## Android Integration section with either:

1. A backend-side example (the Kotlin SDK's actual use case — Ktor/Spring), plus a pointer to Android Checkout SDK for the in-app half; or
2. An Android example that fetches checkout_url from the reader's own backend and hands it to DodoCheckout, with no bearerToken in app code.

Option 1 is probably cleaner — the Kotlin SDK is a server SDK, and an "Android Integration" section on it invites exactly this mistake.

Worth checking the other backend SDK pages for the same pattern.

[rohit-jsfreaky]

I’m working on this. I’ll remove the client-side Kotlin SDK example and make the boundary explicit: checkout sessions are created on the backend, then Android opens the returned checkout_url with the Android Checkout SDK. I’ll keep the change scoped to this Kotlin section and validate the existing guide links.