I have a read-only web API for use with a mobile app. There are no user logins - just searches performed against an API and a set of results returned.
NOTE: This isn't about USERs logging in as the questions I can find are about, but just one log in for the whole API, just to confirm that it is actually our iOS app accessing it, and not some Android app that somone else made and is just using our API.
I'd like only my app to be able to access the API. Even though the data is public, I don't want anyone to be able to use the API.
I was going to add a basic key check to be sent with each request, as many APIs do, a simple
key=sjetow3vthw3iulbtq4wv in the request and verify it, but I understand that keys can't be securely stored in iOS apps, like at all....?
Is this impossible to achieve? Say a website like Booking.com and their iOS app - surely it can't be right that there's no protection on their API, and anyone could develop an app againt their API? Can they be secured at all?