It seems that you are starting a new project, and as a Developer Advocate for security I would like to recommend that you start your new project with a secure by default approach, and to help with that I recommend that you read this 3 articles I wrote, and take a look to a very basic Andorid mobile app, that shows how to hide an API key in native C code.
Why Does Your Mobile App Need An Api Key?
WHO vs WHAT is Accessing your API server
While user authentication may let your API server know who is using the API, it cannot guarantee that the requests have originated from what you expect, your mobile app.
Now we need a way to identify what is calling your API server, and here things become more tricky than most developers may think. The what is the thing making the request to the API server. Is it really a genuine instance of your mobile app, or is a bot, an automated script or an attacker manually poking around your API server with a tool like Postman?
Public vs Private APIs
Now just because the documentation for your API is not public or doesn’t even exist, it is still discoverable by anyone having access to the applications that query your API.
Interested parties just need to set up a proxy between your application and the API to watch for all requests being made and their responses in order to build a profile of your API and understand how it works.
How to Extract an API Key from a Mobile App by Static Binary Analysis
The range of open source tools available for reverse engineering is huge, and we really can’t scratch the surface of this topic in this article, but instead we will focus in using the Mobile Security Framework(MobSF) to demonstrate how to reverse engineer the APK of our mobile app.
Steal That Api Key With A Man In The Middle Attack
So, in this article you will learn how to setup and run a MitM attack to intercept https traffic in a mobile device under your control, so that you can steal the API key. Finally, you will see at a high level how MitM attacks can be mitigated.
Android App Example
The best way to hide the API key in an Android mobile app is by using a native C code implementation, as it his done here, and then loaded here, and exposed here, and finally used here.
Do You Want to go the Extra Mile?
If you are willing to, then I recommend you the OWASP Mobile Security Project - Top 10 risks:
The OWASP Mobile Security Project is a centralized resource intended to give developers and security teams the resources they need to build and maintain secure mobile applications. Through the project, our goal is to classify mobile security risks and provide developmental controls to reduce their impact or likelihood of exploitation.
