in the past I expirmented with Google available api tools, like the Drive and Youtube api's.
The way it works is after you purchase a deveopler account, you are granted to many of Google services through api's, which in order to use, you need a uniuqe api key that is linked to your account, and appended to each of the requests url.
In the begining I thought it was a smart idea to use the key -> account binding, for instance, if an api key is bypassing the tos, Google can simply ban the account.
But then I found out it is very easy to reverse engineer the authorization key in Android/iOS apps using MITM tools such as Mitmproxy. Using that approach, I managed to find the Youtube official app api key, and many other apps that use those services, so my question is, isn't Google shoot itself in the foot by using the autorization key that way? As apps can still remain anonymous using their services, and even pretend to be other accounts!.
Isn't it a better idea to build sdk which will receive the account key and use it to generate locally a one time key for each request? Of course this could be reverse engineered as well, but it will be much harder...