When a user logs in the App, they are given a unique API key (each user's API key will be different). The user uses this API key to make HTTP requests. Currently, the API key is saved in an SQLite database on iOS and it is retrieved from the database when you make API requests. However, I'm not sure how safe this is. On the backend, the user and backend team have the ability to delete the API key and we are using SSL.

I've thought about keychains, but I was told it doesn't really protect much.



The answer you linked, from 2013, is out of date. You can have secure enclave-backed Keychain private keys now. See Apple's article on how to store private keys in Keychain.

You will have to re-architect your API to use a public key scheme, but there is no way around this, since any fixed API key will require the key to be in memory at some point anyway.

  • The keychain won't be able to protect my API key because it will be in memory at some point, is that correct? – Curt Rand Sep 13 '18 at 16:32
  • @CurtRand That is correct. Your API will have to be changed so that it verifies a public key signature instead or in addition. – user71659 Sep 13 '18 at 16:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.