Where do you put API keys in mobile app?
For storing fixed API keys, the following common strategies exist for storing secrets in your source code:
- Hidden in BuildConfigs.
- Embedded in resource file.
- Obfuscating with Proguard.
- Disguised or Encrypted Strings.
- Hidden in native libraries with NDK.
- Hidden as constants in source code.
Why OAuth API keys and secrets aren’t safe in mobile apps?
Instead of shipping a client_secret in a mobile app, the way PKCE works is the app creates a new random secret every time it starts the OAuth flow. This way there are no secrets shipped ahead of time, and there is nothing useful for an attacker to steal.
Why are OAuth API keys not safe in mobile apps?
OAuth solves this problem by not shipping any secrets in mobile apps, and instead involving the user in the process of getting an access token into the app. These access tokens are unique per user and every time they log in.
Is it possible to get secret API keys?
Let’s take a look at two ways it’s possible to hack secret API keys out of mobile apps. It’s fairly straightforward to extract API keys from a JavaScript app. As soon as you load the web page hosting the JavaScript app, your browser downloads the entire source code so it can run it.
How does a client authenticate an API call?
When your client wants to make an API call, it asks the app auth service to authenticate it (using strong remote attestation techniques), and it receives a time limited (usually JWT) token signed by the secret. The token is sent with each API call where the endpoint can verify its signature before acting on the request.
When to use OAuth 2.0 client ID and secret?
Well, traditionally, OAuth 2.0 apps are issued a client_id and client_secret when the developer registers an app. This works fine when the app is running on a web server as the users of the app never have access to the source code and therefore don’t have the opportunity to see the secret.