I'm currently developing a mobile app (iOS based initially) that consumes multiple APIs. Currently we're storing API keys as strings in the the prefix header file, and initializing most of the APIs when the app loads. It's occurred to us that it is quite easy to extra the API keys from the executable on a rooted device. Furthermore, if one of our API keys gets compromised and we are forced to change it, we're handcuffing ourselves by hardcoding these values in the executable.

What is the most secure way to store these API keys, and furthermore what is the most secure way to distribute them over the air (ie using a remote configuration pattern)?


You want to store them using apples keychain bindings and distribute them over SSL. Here is a good wrapper for the keychain bindings


Edit - Initially, I thought you were worried about someone stealing your user's key. I see you are worried about your own dev api keys. Just keep the keys on your own server and pipe the api content through your own backend setup. That way the API keys are always safe.

  • but who will stop someone from also accessing the server to retrieve the keys for themself?
    – james
    Sep 16 '16 at 15:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.