Search code examples
securitymobileapi-designapi-key

Security of Mobile Backend API key

Suppose I am developing a mobile application that makes calls to an API server. The API server is secured by an API Key.

I cannot hard-code the API Key inside the mobile application because it can be stolen.

How can I protect the API key?

Solution

  • How is that problem usually solved?

    (It sounds like the API-key you are trying to protect is for an API service that you don't own.)

    One approach is by using an authentication server. The private API-key is kept on the authentication server and only shared after a valid login.

    So how does this work?

    • User on the mobile client enters a login & password
    • These credentials get sent to an authentication server where they are verified
    • If the login is valid, the API-key is sent to the mobile client

    Architecturally, you would need a separate authentication server which would leave you with 2 different servers:

    1. Some API-key server that you need a private API-key to use

    2. Authentication server (used to verify user login and exchange private API-keys)

    enter image description here

    A second approach is to use a pass through server. The private API-key is never shared in this approach. It is possible to add authentication onto the pass-thru server, but not required.

    So how does this work?

    • Mobile user contacts the pass-thru server for data from the API
    • Pass-thru server makes the api call (with the stored private API-key)
    • The API server responds with data to the pass-thru server
    • Pass-thru server forwards the API response to the mobile app

    enter image description here

    In this case, you own the pass-thru server so you never need to share your API keys and user authentication is optional.