I'm trying to design an Android Analytic service where every user's application who register in this service needs to download our SDK. The SDK itself need to communicate with our API server. The point where I ran into the problem, is that I don't know how to implement a proper way of authentication for each application in order to be able to communicate with our API server.
I have already generate a unique API key for each user's application, but I don't know how to handle the authentication process, since if we assume the API key as the only factor of authentication it can be easily stolen by the hacker.
In the other hand, I read that
JWT would be the best case, but whats difference by sending the API-Keys and getting the Access-Token where again both of them can be easily stolen? now should I use
OAuth 2.0 or something else?
Any ideas would be appreciated...