Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm currently developing a mobile app (iOS based initially) that consumes multiple APIs. Currently we're storing API keys as strings in the the prefix header file, and initializing most of the APIs when the app loads. It's occurred to us that it is quite easy to extra the API keys from the executable on a rooted device. Furthermore, if one of our API keys gets compromised and we are forced to change it, we're handcuffing ourselves by hardcoding these values in the executable.

What is the most secure way to store these API keys, and furthermore what is the most secure way to distribute them over the air (ie using a remote configuration pattern)?

share|improve this question

1 Answer 1

You want to store them using apples keychain bindings and distribute them over SSL. Here is a good wrapper for the keychain bindings

https://github.com/carlbrown/PDKeychainBindingsController

Edit - Initially, I thought you were worried about someone stealing your user's key. I see you are worried about your own dev api keys. Just keep the keys on your own server and pipe the api content through your own backend setup. That way the API keys are always safe.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.