Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have an application that I am writing for both iOS and Android; this application will be served by a ReSTFUL API running on a cluster of servers on "the internets". I am curious how the rest of the world is going about securing their APIs so only specific applications running on iOS or Android can use these APIs.

I could go the same route as other OAuth providers by providing a key/secret combination (2-legged OAuth), however, what do I do if I ever have to change these keys??? Do I create a new key/secret for every person that downloads the app???

The application is a social-based game that will allow the user to interact with other "participants" in the game based on location, achievements, etc.

The API will provide the following functions:

-Questions, Quests, etc -Profile Management -User Interaction -Possible Social Interaction

Once the app gains traction I plan on opening up the API ala Facebook, Twitter, etc. Which is easy enough, I plan on implementing an OAuth Server and whatnot. However, I want to make sure, during this phase, that only people who are using the application can access and use the API.

share|improve this question
Really need some details about what your app is doing and what needs to be secured -- could be tricky. Or not. – Wyatt Barnett Jun 18 '12 at 15:07
well... the application is a social-based game that will serve up questions, other users responses, manage user profiles, user interactions, etc. – El Guapo Jun 18 '12 at 15:14
Ok, you might want to add that to the question . . .. – Wyatt Barnett Jun 18 '12 at 15:15
This is the basis of a good question, and not necessarily specific to iOS / Android. Any WebApp developer will potentially need to address this issue. More details please, so a solid question can be formed. – GlenH7 Jun 18 '12 at 15:33
Sure... give me a bit and will update the question and tag it properly – El Guapo Jun 18 '12 at 15:34

There is no way you can be sure that the application at the far end of the wire is the one you think it is. You can't prevent someone reverse-engineering the communications and API and running their own app. You can (of course) make it difficult, for example by encrypting the traffic, and by making the protocols difficult to emulate even if decrypted.

share|improve this answer
I think what I may do is follow the 2-legged OAuth paradigm and produce one set of keys/secrets that all of "my users" (the devices that download my app) will use and version the key/secret combination... if I need to invalidate that key/secret I can and then the next time one of the units tries to communicate I can just regenerate them – El Guapo Jun 20 '12 at 17:46

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.