Disclaimer: I’m not an expert in this subject
Putting the keys in Firebase, and downloading them at runtime,
could be a working solution.
But to access that Firebase, you would need an accessToken, and the cycle repeats.
Basically, you would always need some kind of key in the app itself.
You could try looking into DexGuard, as that would encrypt (or at least obfuscate) Strings in you app.
https://stackoverflow.com/questions/10220069/does-proguard-work-to-obfuscate-static-string-constants/12665420#12665420
Anyway, this is not specifically related to Kotlin programming language;
But it’s a problem that could happen in any app.
It could be better asked on StackOverflow