Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm currently developing a mobile app (iOS based initially) that consumes multiple APIs. Currently we're storing API keys as strings in the the prefix header file, and initializing most of the APIs when the app loads. It's occurred to us that it is quite easy to extra the API keys from the executable on a rooted device. Furthermore, if one of our API keys gets compromised and we are forced to change it, we're handcuffing ourselves by hardcoding these values in the executable.

What is the most secure way to store these API keys, and furthermore what is the most secure way to distribute them over the air (ie using a remote configuration pattern)?

share|improve this question

You want to store them using apples keychain bindings and distribute them over SSL. Here is a good wrapper for the keychain bindings

Edit - Initially, I thought you were worried about someone stealing your user's key. I see you are worried about your own dev api keys. Just keep the keys on your own server and pipe the api content through your own backend setup. That way the API keys are always safe.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.