3 ms·

I m wondering if there is any alternative to storing API keys and tokens in the source of the app ? Proxying all calls through our own server seems like an exp

I m wondering if there is any alternative to storing API keys and tokens in the source of the app ? Proxying all calls through our own server seems like an expensive way of solving this problem. Because if the client is compromised it doesn't do much anyway.

chr7z 12y ago
There is a tool for moving API keys out of the source: Keystok stores encrypted API keys and tokes in a cloud service and lets the App / client retrieve them during runtime. Its not just about moving keys out of the source, but about getting rid of local config files altogether. Related post on their blog: http://blog.keystok.com/why-i-stopped-using-local-config-files-and-you-should-too/ http://blog.keystok.com/why-i-stopped-using-local-config-fil... Disclosure: I'm a developer at Keystok.
- lucian1900 12y ago
  That is much worse, though: you're actively disclosing your API keys to a third party (keystok).
- kuschku 12y ago
  And a developer with Apktool could still modify the app and get the keys, you win nothing with this solution.
HarrietJones 12y ago
Shoot me down if I'm missing something obvious here, but: One solution would be for Apple and Android to have an "environment" section for applications. You'd be able to set these environment keys when publishing the app. Apple and Android could provide an API to these environment keys, and they'd be published in an encrypted form as part of the application manifest. Bonus Points: It would be relatively simple to provide the facility from the AppStore provider for changing / cancelling these keys.
- jaegerpicker 12y ago
  While not an API as such both OS's provide a User defaults/App default storage area. It's not that hard to encrypt your key in an outside process and then have your app write it to that location in encrypted format. Then make a request to the server to supply the key to decrypt the api key. Then again you are making it a little harder to break in but not much. The better tactic is to just limit the API access to as little as possible and make the API as secure as possible.

chr7z 12y ago

There is a tool for moving API keys out of the source: Keystok stores encrypted API keys and tokes in a cloud service and lets the App / client retrieve them during runtime. Its not just about moving keys out of the source, but about getting rid of local config files altogether. Related post on their blog: http://blog.keystok.com/why-i-stopped-using-local-config-files-and-you-should-too/ http://blog.keystok.com/why-i-stopped-using-local-config-fil... Disclosure: I'm a developer at Keystok.

lucian1900 12y ago
That is much worse, though: you're actively disclosing your API keys to a third party (keystok).
kuschku 12y ago
And a developer with Apktool could still modify the app and get the keys, you win nothing with this solution.

HarrietJones 12y ago

Shoot me down if I'm missing something obvious here, but: One solution would be for Apple and Android to have an "environment" section for applications. You'd be able to set these environment keys when publishing the app. Apple and Android could provide an API to these environment keys, and they'd be published in an encrypted form as part of the application manifest. Bonus Points: It would be relatively simple to provide the facility from the AppStore provider for changing / cancelling these keys.

jaegerpicker 12y ago
While not an API as such both OS's provide a User defaults/App default storage area. It's not that hard to encrypt your key in an outside process and then have your app write it to that location in encrypted format. Then make a request to the server to supply the key to decrypt the api key. Then again you are making it a little harder to break in but not much. The better tactic is to just limit the API access to as little as possible and make the API as secure as possible.