Flutter REST API Security

Question

I'm using REST API key in my flutter project in lib folder so is there any chance for someone to decompile the apk and see my API key? Is it secured?

Solution

Can a user decompile the apk and get rest api key and write into my database by postman or sth like that?

If you don't share your APK which is generated in debug mode, it won't be easy to access your API key. You should always consider building your APK in release mode. And you can obfuscate your APK too.

Comments

[mousetail]

Yes, you should generate a API key for every user of your app

[knnkrt7]

Thank you for answer. Can a user decompile the apk and get rest api key and write into my database by postman or sth like that.

[mousetail]

Even if they couldn't, a user can intercept all web traffic. SSL does not protect you when other apps can read your memory.

[knnkrt7]

So whats the solution to protect my data from all attempts

[mousetail]

You should never give sensitive data to the client. Either have your own API that has authentication and proxies the third party API, or if you cannot give each user their own key to the third party API and limit the permissions.

[Joy Terence]

In case of mobile clients, you can save the sensitive data such as token, api_key...in keychain (iOS) or in keystore (android). To achieve this in flutter, have a look at flutter_secure_storage