Android where and how to store keys?

Question

Android

An urgent question that torments for a very long time. How and where to store keys in Andorid?
If on an example, then: there is a service that is accessed through a certain token and its cost is not cheap. Of course, I would not want to give them out to a third party, and resort to data encryption algorithms.

@NonNull
    public static String encryptString(@NonNull String text){
        try {
            Cipher cipher = Cipher.getInstance("AES/ECB/PKCS5Padding");
            SecretKeySpec secretKey = new SecretKeySpec(KEY.getBytes(), "AES");
            cipher.init(Cipher.ENCRYPT_MODE, secretKey);
            byte[] array = cipher.doFinal(text.getBytes());
            return new String(Base64.encode( array,Base64.DEFAULT));
        }catch (Exception e){
            e.printStackTrace();
            return "";
        }
    }

    @NonNull
    public static String decryptString(@NonNull String text){
        try {
            Cipher cipher = Cipher.getInstance("AES/ECB/PKCS5Padding");
            SecretKeySpec secretKey = new SecretKeySpec(KEY.getBytes(), "AES");
            cipher.init(Cipher.DECRYPT_MODE, secretKey);
            byte[] base64 = Base64.decode(text,Base64.DEFAULT);
            byte[] array = cipher.doFinal(base64);
            return new String(array);
        } catch (Exception e) {
            e.printStackTrace();
        }
        return "";
    }

As you can see, public key encryption/decryption is used here. T / e / we first encode the keys to an expensive service and store it in our project without being particularly afraid for its direct theft. But here an urgent question arises - if Android is so bad with bypassing decompilation, and obfuscation is unlikely to stop an attacker in search of the desired one, then where and how to store such keys?

Answer 1

You will not hide the key anywhere on the device so that it cannot be reached, I guarantee you this.
The only option that I see is an HTTPS connection to the server and storing the key there, but even here it’s all the same, you can get it if you wish.

Answer 2

And what prevents you from proxying this service through your site? And passwords will be safe and you will be able to control access.