CODEWITHSUNDEEP
javaandroidhide
DaSt1986
DaSt1986

Reputation: 1

Hide variable value

I'm writing a small Android app and I need to hide some variable values. I have a API key I got from the content provider who is providing me content to show in my app that I need to retrieve data from them. Because it is being used in an encryption algorithm, it is of vital importance the code isn't leaked.

I need to save the API key in my code and be sure it isn't retrievable by the bad people in the world. What I do now, is save them in my code as a variable:

private static final String API_KEY="mysupersecreatapikey";

After the app is compiled to an APK file, this is, in my opinion not retrievable anymore. Am I doing it in the right way now, or is there a better solution?

Upvotes: 0

Views: 439

Answers (2)

confusopoly
confusopoly

Reputation: 1245

If you put the API key into the client in any form that can be used by the client it will be possible to get to it somehow. Maybe by unwrapping the APK and decompiling the code, maybe by traffic sniffing. That private static final variable for example can likely be extracted by a decompiler (if it's bytecode).

If you want to make really sure that none of your users can get to the API key then your app shouldn't be using it directly. Instead have it connect to a web service you set up that serves session IDs for example. That web service that runs on a server that you have control over (quite a few options) would then be the only piece of software that knows the API key.

But depending on the use case this might be a complete overkill solution to this problem.

Upvotes: 1

Josh M
Josh M

Reputation: 11947

You could store the API key in a file located in storage. You can encrypt the API key when you write it to the file and then you can decrypt it when you are reading it (upon program execution)

Upvotes: 1

Related Questions