I have a mobile application, for Android and iOS (both native), that communicates with the backend through a REST API (over HTTPS).
The application allows users to sign in or use the app as a guest, but in both cases I need to track user's activity based on which we send them push notification. The activity is also used for statistics on daily installs and daily usage.
In order to do so, the first thing the application does on startup is to check if it has a device UUID set, and if does not it sends a "register-device" request to the API which generates a new UUID and stores it into the database. The generated UUID is returned to the app and stored persistently. The app then sends the UUID within each request. This allows us to know how many devices/users use the app, daily activity and if available, the device's push notification token.
This works relatively well but I have some concerns regarding security. Let assume that some one is able to deobfuscate the app and gain the API key. With the API key he can access the API in the same way as the app can and can start sending thousands of "register-device" requests, which would fill the database and gradually decreasing API performance.
Is there any way to overcome this issue? I could generate the UUID on the client side, but that would lead to the same issue - the attacker would just need to generate a valid UUID and send it to the API.