I and a friend are developing a web game. The front-end to back-end communication will be carried out by the means of an API.
We realized that someone could then easily hook up to our API and make a clone that uses our API.
So we googled a bit and found out about HMAC signatures. While it sounds great, how could we protect its key that is embedded in the code from someone who would just copy the entire source and make slight visual modifications?
How could we do this in a better way? Is there a way of implementing the key code that is copy proof? Or maybe we should use a completely different approach (because I am not so sure if embedding the key in the code itself is that smart)?
I did very similar project before. I assume your source code will be distributed to 3rd party as open-source or obfuscated open source.
Let me explain in two conditions:
If you do not store the key in the source code
This solution is similar as DannyNiu's answer above. Receive the key from server only when need the key. It can enhance the security in some aspect. The disadvantage is that, in real application environment, the key must be stored locally for many reasons.
If you store the key in the code
The people have your code can be static and dynamic code analysis to retrieve the key. Thus, you need the code protection methods. For example:
2a. Code obfuscation
There are many code obfuscation projects available online, such as ollvm. The objective is to make the code algorithm not human readable. It can prevent static code analysis efficiently. But people can still read variable values through dynamic debug. The challenge is to decide which parameter's value is the key value.
2b. white-box cryptography
The key is still stored in the code, but not the normal format. The key hides in a crypto table (at least hundreds of kbs). The whole table is the key. For example, white-box AES and github project here. You input the ciphertext/plaintext to the tables and receives the plaintext/ciphertext. The value is exactly same as standard AES. Reverse engineering the key from tables is challenging. You can google more on this. For example, static white-box and dynamic white-box cryptography.