Your first line of defence should be a secure API where an attacker doesn't gain anything by knowing it. You can add obfuscation, but ultimately if the client

Your first line of defence should be a secure API where an attacker doesn't gain anything by knowing it. You can add obfuscation, but ultimately if the client is shipped to the user you must assume an attacker can reverse engineer it.