When a user logs in the App, they are given a unique API key (each user's API key will be different). The user uses this API key to make HTTP requests. Currently, the API key is saved in an SQLite database on iOS and it is retrieved from the database when you make API requests. However, I'm not sure how safe this is. On the backend, the user and backend team have the ability to delete the API key and we are using SSL.
I've thought about keychains, but I was told it doesn't really protect much.