I have spent the better part of 2 weeks looking at a solution to secure my game. It's a game for Android/iOS that has its own server/database.
So far, the only security I have is salt+hash passwords. But anyone can call my API.
So I wanted to change this, one solution I found that is very simple is to hash my query when calling my API using a secret that is stored in both the client and server. Of course this means if someone decompiles my app, they can access my API.
Worst case scenario, they can give themselves free premium version of my game ($4), and increase their own rank (which I would see, and just remove the user). I am okay with that, it would become a problem if they could do it for any user, but that should be impossible.
In my opinion the solution is okay for this threat model, if they want to go through all that trouble just to save $4, I'm okay with that.
Does anyone with more experience see a fault in my approach? If it is good enough, what is a good way to obfuscate the secret in my client?
Reference: Answer by speedplane Here