Android Question Best place to store api keys?

put the API-Key variable in Process_Globals sub and compile with Obfuscation

Alexander Stolte said:

put the API-Key variable in Process_Globals sub and compile with Obfuscation

Click to expand...

You think this is enough to ensure the token does not get "stolen"?

It is far easy to get them from the APK.

DonManfred said:

You think this is enough to ensure the token does not get "stolen"?

Click to expand...

It's the recommended way from @Erel

Alternative, store the api key inside a image:

Alexander Stolte said:

Alternative

Click to expand...

i do like this solution much more

Alexander Stolte said:

It's the recommended way

Click to expand...

It does make things a bit harder.
But not much in my opinion.

Without authentication it can be impossible to protect your encrypted data you may harden the process of fetching those keys but you wont prevent it!

In my opinion store your sensitive encrypted "keys or data" in a backend that you will connect and use later to authenticate who can receive those sensitive information..

Addo said:

Without authentication it can be impossible to protect your encrypted data you may harden the process of fetching those keys but you wont prevent it!

In my opinion store your sensitive encrypted "keys or data" in a backend that you will connect and use later to authenticate who can receive those sensitive information..

Click to expand...

But what if traffic will be intercepted by the moddle man? I think that the data sent or received should be encrypted by itself even with https.

Alex_197 said:

But what if traffic will be intercepted by the moddle man? I think that the data sent or received should be encrypted by itself even with https.

Click to expand...

For sure sniffing is basic expectation during requesting any information through the network!
Whether using ssl or not..the idea ? is to cost the requester subscription fees to get access to this service! Although everything can be handled in the server side without sending the client side any thing or keys but authentication!!

Each request in that case will be handled in the server context and the client will expect only a replay with none sensitive data! Also you can create a log to each request used the sensitive key or token and when you fall in the sensitive data breach you will catch the one who leaked your data through decrypting his requests since you logged already his account information while using this sensitive data!
In the oop case using key to communicate with open Ai for his app clients!

Briefly a thief should break the window or crush the door to get in. which is your server in that case who keep those data needs to be broken or crushed.

The best place is in your server side.
Your app=>>your Backend=>>OpenIA.

And you will track the request and limit by hour or day.
Or ban an IP or device by Mac or Android Identifier.

hibrid0 said:

The best place is in your server side.
Your app=>>your Backend=>>OpenIA.

And you will track the request and limit by hour or day.
Or ban an IP or device by Mac or Android Identifier.

Click to expand...

I'd love to see some code on how you are doing this if possible.

So in my app customer types info on a vehicle then presses the AI button which rephrases it for them.
Are you saying I should submit the users input to the server and then return the result instead of doing it on the device?

tsteward said:

I'd love to see some code on how you are doing this if possible.

So in my app customer types info on a vehicle then presses the AI button which rephrases it for them.
Are you saying I should submit the users input to the server and then return the result instead of doing it on the device?

Click to expand...

Use any communication protocol as a server and connect your app client to it..every thing will be running under this server context and your client app will be such a place to receive what ever you like.

Use an encryption library.
Encrypt the key with a PW.
Store the encrypted key and the PW in your app in different places using misleading names.
Decrypt the key when you run the app.
Not bullet proof but will take someone some time to figure out.
You could also put the encrypted key and the password in external files then load them and unencrypt at run time.
You could also store them in unused tags on some of your layouts.

I'm starting to use the OpenAI API in my apps, and due this thread (to avoid the same problem), I found this information:
"Never deploy your key in client-side environments like browsers or mobile apps."


So, I think, even you encrypt the key or download from the hosted database and use in your app, you will get a problem.

The recommended way is using a server to connect to OpenAI API and get the response:
"Requests should always be routed through your own backend server where you can keep your API key secure."