I see some SaaS require to import "App Secret" into your application also with "Application Key". I understand the "Applicaton Key", but can not understand the "App Secret". Here is why:

  1. I can decompile the application and get app secret easily.
  2. If you are encrypting the traffic between you and server with it, and your OS doesn't allow me to decompile your application, I can still mess with your data by replicating the traffic request and send it million times.

Why use "App Secret" in mobile applications? Can't we say actually it is public because it's easily accessible from outside? Application key is also accessible, what is the difference, is it because of experience lack of that SaaS?

  • 1
    I think the ones responsible for these "App Secrets" (when it is separate from your API key and is going to be embedded in your application), may not really be things things through. Most likely they are just used to the idea of usernames and passwords.
    – lzam
    Sep 22, 2014 at 18:31

1 Answer 1


App secrets are related to the "Web Server Auth Flow" (notably OAuth2), which is how one server authenticates to the other that is is allowed to access the resources that server provides. You can think of it as an "authorization password," where the password allows the calling service access to the service being called.

Mobile clients must not be trusted, and should never use an app secret; this is an inherent security risk, as it can allow a malicious app access to the service. Once an app secret is out in the wild, the service needs to have it changed to prevent malicious apps from abusing the service on behalf of users.

Note that you can't use replay attacks with OAuth2 because it uses a random number to salt each transaction, although the decompilation issue is still very much a factor. In fact, there have been articles written about the extreme number of Android apps that are vulnerable because of app secrets being leaked.

Once you have an app secret, you can emulate the app that the secret key corresponds to, and you can't tell the difference between an authorized, published app, and a malicious clone. Many developers don't understand that the app secret is the equivalent of a password or a private encryption key, and should be treated as such.

Mobile clients and other untrusted apps (web browser-based apps) should use the "user client auth flow", in which only the app key is used.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .