I and a friend are developing a web game. The front-end to back-end communication will be carried out by the means of an API.
We realized that someone could then easily hook up to our API and make a clone that uses our API.
So we googled a bit and found out about HMAC signatures. While it sounds great, how could we protect its key that is embedded in the code from someone who would just copy the entire source and make slight visual modifications?
How could we do this in a better way? Is there a way of implementing the key code that is copy proof? Or maybe we should use a completely different approach (because I am not so sure if embedding the key in the code itself is that smart)?
Sources:
https://softwareengineering.stackexchange.com/a/369938
https://security.stackexchange.com/a/20301