The use of paid API is increasingly rising each year. For example, IBM, Google and Microsoft are providing paid API such as Text to Speech, Speech to Text and Image to Text and vice versa.

I have a question about what happens If I build an app and publish it:

1.What happens when another person use Wireshack or reverse engineering to obtain the key of this API and then use it in their app or sell it?

2.Will I be paying for this even though my clients are not the people using this API?

3.Is there a way to reduce or prevent this from happening?

I am just worried about this and sure this is happening or must have happened at some point.


I asked this because I saw my Google Map API with the Wireshark software.

My initial solution is to make each user create username and password and apply restrictions to each individual user but those companies I mentioned up don't do that. They simply use one single key for their services.

  • 3
    Yes, there is a way to avoid it : instead of doing request directly to the api service, do them to your server which do them with the apikey to the api service.
    – Xavier59
    Mar 6, 2017 at 20:14
  • 1
    I never thought about that. This means I need another server for the app. It would be good if you put this as answer.. I still need answer to other questions.
    – Programmer
    Mar 6, 2017 at 20:16

2 Answers 2

  1. As you may expect it, there is no way to fully protect your api key if it is directly used by a client application. The user can sniff his netowrk (the use of https or of an encrypted channel might still help but is only a matter of time as the user can see the full handshake) or reverse engeneering the software (same here, you can encrypt the api key but with some work, you can always get the key back).
  2. Yes, you will still get charged even if the api key is not used accordingly to what you may expect simply because the api service has no way to know if it is some of your intented use.
  3. There is only one solution which can fully secure your api key from being grabbed and used as not intended : do everything with the api key server side. Your server will act as proxy between the client application and the api service and thus, the client can't be aware of the api key. Howewer, it may cost you additional cost to set up a server.
  • 2
    Doing everythink on the server side will change nothing, just hide the api key but the hackers can still access the service at zero cost using your server !
    – zeus
    Aug 6, 2018 at 6:43
  • 4
    @loki True but with this solution, you can implement login system for each user and add request limitation to each account and IP Address. You have control over how your API is used.
    – Programmer
    Nov 4, 2018 at 22:49

If you are calling API from publicly open websites, there is no 100% secured solution.

You can make it difficult using encryption/decryption, obfuscation, proxies, some header checks, code changes on each build and all - but it won't be 100% secured.

Because whatever you've done can be easily reversed engineered by a good hacker as he can be the legitimate user and he doesn't need any valid login or IP to use publicly open websites, so he has access to all JavaScript/HTML code and he can monitor the network requests from website and analyze the pattern.

  • encryption/decryption wouldn't work here because they can be reversed. I am calling it from an app not website but even though it's from a website, Xavier59's answer would still work. You make the request from your server not on on the client.
    – Programmer
    Nov 4, 2018 at 22:52
  • Xavier59's answer would not work because your server side request can easily be captured by the network monitoring and hacker will just make the same request to your server and he would still get the expected data.
    – Jay Shah
    Nov 6, 2018 at 18:19
  • Also, if you're using native android/iPhone app, it's difficult to reverse encryption/decryption because hacker won't have direct access to your code unlike website. However, there're some de-compilers which may help the hacker to get the code.
    – Jay Shah
    Nov 6, 2018 at 18:28
  • No, my server is making the request. The request is done on my server, from my network. You can't capture it unless you're on my network but you're not. Your computer makes request to my server, my server then makes request to the API then returns the result to your computer. Is that hard to understand? It's not difficult to reverse encryption/decryption on iOS. I was able to do so within minutes and get all the code I needed. You can do it during run-time and get the API code or any variable value so that's not even safe.
    – Programmer
    Nov 6, 2018 at 18:54
  • The only thing you can capture is the request from your computer to my server not the request from my server to the API server such as the Google Map server. My API key is still 100% private.
    – Programmer
    Nov 6, 2018 at 18:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .