I am creating a platform which is based on REST APIs. My platform has apps and web both.

I don't want to make my APIs public and want that my APIs can be used by my own clients (app and web) only.

I can use the secret key system to authenticate the client but any one can get it from the app code by decompile the app code.

So how do implement it in secure way? How Amazon/Google/Facebook do it?


How can I secure the secret_key so that no one can get it?

  • 1
    The server has no way to know what software is sending HTTP requests to it. Why would you want to do that? Google, Facebook, Amazon, etc. don't try to ensure only their client software can talk to their servers. If you're willing to write software to talk to their APIs, you can. On compliant browsers, there is CORS, but that is something different. It cannot prevent people from using e.g. curl to send requests to CORS protected end points. The security of your API server cannot rely on people not being able to send requests using curl, because they are always able to send requests using curl. – Z.T. May 23 at 17:01
  • You might want to read up on OAuth client_secret. – Swashbuckler May 23 at 17:08
  • do your users have accounts? if so, make them log in to use the API. not logged in = no access. If your users don't have accounts, then you can't actually enforce this 100%, but you can use heuristics, rate limiting, fail2ban, and related tools to mitigate and discourage attacks. – dandavis May 23 at 17:20
  • @Swashbuckler So how can I make the secret-key secure so that no one can get it by de-compile the app code? – Dau May 23 at 17:22
  • 1
    Every time this question gets asked, I have to point out David Auerbach's "Chat Wars: Microsoft vs. AOL" so people know the degree that services that have tried and failed to do this. The technology stack have changed massively since then, but the fundamentals are still pretty much the same (and will always be). – Lie Ryan May 24 at 4:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.