I am creating a platform which is based on REST APIs. My platform has apps and web both.
I don't want to make my APIs public and want that my APIs can be used by my own clients (app and web) only.
I can use the secret key system to authenticate the client but any one can get it from the app code by decompile the app code.
So how do implement it in secure way? How Amazon/Google/Facebook do it?
How can I secure the secret_key so that no one can get it?