We're building an Android library for our Rest APIs that app developers will access with a unique token. Since it's a paid service, and it's a per-request or per-install pricing model, how do we safeguard our paid developers from abuse, say if someone but the developer gets the token by:
- Decompiling the app
- Executing a Man in the Middle attack (even though it's HTTPS) and gets the token
What we're doing at the moment is getting each developer to host their own separate endpoint (server URL) that is hard-coded into the library when we give it to them. This end-point reverse proxies to our API, and this way, we are able to rate-limit requests by IPs and also differentiate traffic. However, it doesn't really solve the abuse part of the problem, and is also too painful if we want to scale to a million apps.
What can we do?