How Should API Keys be Stored?

Mobile app developers keep hearing that they shouldn’t store API keys in their app code but they don’t hear where they should store them. In this article we discuss the topic and provide some practical solutions.

API keys are unique digital identifiers that authenticate requests to the API from a remote client such as a mobile app and are typically used to control API access; they can also be used for identification, rate limiting and billing purposes. Unfortunately, API keys are often inadequately protected and can easily be exploited in a number of ways:

1. Mobile apps can be downloaded from app stores by anyone,reverse engineered and the keys extracted.
2. API keys may be accidentally exposed through public code sharing sites such as GitHub.
3. A Man-in-the-Middle attack can be performed to intercept the traffic between a mobile app and backend API and steal API keys and other secrets.

Risks of Exposed API Keys 

Depending on the functionality of the API and the permissions associated with it, there are a number of risks to your business if your API key becomes available to bad actors:

• Your app can be impersonated and API calls can be made on its behalf, resulting in potential fraudulent activity.
• Bots or scripts can use your API key to rapidly hit rate limits through a DDoS attack on your app. In a pay-per-use model API, your paid quota could be consumed through unauthorised usage. Once these limits/quotas are reached your app may stop working.
• User data may be extracted from your backend servers via the API.

Securing API Keys

To prevent accidentally exposing API keys to the public, it would obviously be best to avoid embedding them directly in the app’s source code. However, this is non-trivial to achieve because the mobile app needs to transmit the API key to the API backend. Here are some approaches which could be considered: 

• Code obfuscation is often used to prevent decompilation and reverse engineering of an app’s source code. While this will slow cybercriminals down and make it harder for them to extract the API keys and secrets, there are readily available tools, such as Frida which can steal the key from memory at run-time and proxy tools such as mitmproxy which can intercept the key in transit from the API.
• An external proxy service can be used but while your API key will be hidden from public view, the proxy itself is also vulnerable to attack.
• Instead of solely relying on API keys, user authentication protocols such as OAuth2 can provide an additional security layer. However, this will not prevent app impersonation or credential stuffing attacks. You can get more detailed information on securing API keys here: https://approov.io/blog/improve-the-security-of-api-keys.

A complete solution is to use cryptographically signed authentication tokens to verify your app’s authenticity and security at run-time. This ensures that API keys can only be used by genuine instances of your mobile app running in a trusted environment. Take a look at Approov Mobile App Protection for further information.