To use our platform and APIs, a client requires integration of iOS and Android SDK on their mobile apps. Each of the clients is issued one API key, like any other platforms such as Crashlytics, MixPanel, etc., to communicate with the server.
We are trying to obscure the keys during any kind network interception or MITM. However, this seems to be a tough job.
So far we have tried following:
1. Storing the client keys in the key store, keychain.
2. Change the header, JSON parameter names to confuse the attacker.
3. Putting the keys in a file and then transmit it over the network.
4. The first and last call method. We are hashing the first request timestamp and then comparing it with the next consecutive calls. If the timestamp is greater than the first timestamp, then we can assume that an attacker isn't trying to replay the calls for abusing the platform.
We cannot allow keys to be seen by the attacker for a reason, each and every call is being billed to the client, and anyone aware of our platform can cause tremendous damage to our customers just by replaying the requests to our server.
How do we ensure that keys are securely transmitted and are not visible to the attacker?
Note: Once the SDK on a mobile app goes live, for a client, we are updating the keys at different hours of the day and storing in the keychain, keystore.