Hmm... The fact that you're so concerned about requests not hitting your web app without going through your Flex front end raises a red flag... Anyway, you can

Hmm... The fact that you're so concerned about requests not hitting your web app without going through your Flex front end raises a red flag... Anyway, you can obscure the key into the code all you want. If it's a string value there's only one place it will ever be when the .swf is decompiled and that's in the constant pool. If it's a number value stored in a variable or even a few concatenated strings it might be a little more difficult since it's not going to come out and slap somebody in the face, but to say it's trivial to retrieve the key would be the understatement of the decade. Before going this route it might be a good idea to decompile some .swf files to see what it looks like. Check out a program called Describe SWF and take a look at the documentation for Flasm. Lots of good info there. There's no good way to secure your Flash/Flex code so it's not worth the effort to even entertain the thought. I develop a bot with a custom Flash player and I'm just amazed out how many people do stuff like this. The best advice I can give you is that anything you put in a Flash file is there for the taking as if you were advertising on your home page. Bad idea.