5

I was working on one Android App which was communicating with RESTFull server. We made an API Key which was inserted in header of GET and POST requests. This API Key was stored in Strings. App is no longer used and also server is down.

I found app.apk file and was curious how it is secure, so I decompiled it's source and found API Key there like this. We didn't use ProGuard because we didn't have time.

The queston is how to store API Keys in android applications because this way I can also obtain Google Maps API Key.

enter image description here

Improve this question

1 Answer 1

Reset to default
8

So, you're asking if you can store the API Key in the App, but also protect it from being stolen? This is not possible.

There is a possible solution to make theft more difficult. Use OTP XOR encryption so that the API Key is split into two parts that must be combined.

The first part is stored in your application.

The second part is downloaded from your server equipment and then stored in the App-Private data, preferably in such a way that does not make its purpose obvious. Alternatively, you could 'not store' the second part, (keep it in Application Memory or Intent Extras only) but then you'd have to download it from the server every time the app is launched.

Then you can use Progard to make the overall application more difficult to understand.

Of course these only make theft more difficult, and do not actually secure the Key from theft.

If you really need to secure the key, then you'll have to route all requests to the Google Maps API through a Proxy server which you control. That Proxy server can add the API Key to each request as needed.

Improve this answer
3
  • 2
    In addition make sure to communicate to the API via SSL. This way one cannot gain the key by monitoring the traffic.
    – mad_manny
    Commented Aug 22, 2017 at 11:01
  • Adding something to mad_manny's comment: Of course you should use TLS for communicating to the API, but it is still easy to perform a MITM attack and gain access to the API key this way.
    – rumpel
    Commented Mar 25, 2021 at 14:43
  • If the app only uses root CAs then it would be more difficult.
    – 700 Software
    Commented Mar 31, 2021 at 16:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .