This question is an exact duplicate of:

In my scenario, I have an Android mobile application which calls my back end REST services. I want prevent other application to call my back end REST services. If I use certificate and shared key as well as obfuscating my application's code, attackers can beautifier my source code and do reverse engineering.

marked as duplicate by Steffen Ullrich, ThoriumBR, LvB, AndrolGenhald, Teun Vink May 16 at 21:15

This question was marked as an exact duplicate of an existing question.


This is near impossible to achieve (short of white-listing IP addresses). Given someone has enough time and resources, they will almost certainly be able to send calls to your API outside of your client. In general, you want to assume attackers know everything about your API and design your API to be resilient to attacks (Ex. good authentication practices with correct limiting, etc.), otherwise, you would likely be fighting a losing battle.

A great example I like to bring up is the Pokemon Go API (link here). Hackers were quickly able to create 3rd party clients that would send erroneous location data and allow users to catch Pokemon from all over the world. Despite API updates, hackers continuously re-reversed engineered the necessary steps to send valid API calls.

Not the answer you're looking for? Browse other questions tagged or ask your own question.