Android Question Best place to store api keys?

[tsteward]

I am seeking advice on the best and most secure place to store API keys.

Recently, my OpenAI key was deleted because it had apparently been leaked, according to OpenAI.

Realizing that hard coding the key was not a smart idea, I have since moved to storing it in my hosted database and downloading it when my app starts.

This approach seems more flexible, as I can replace the key without needing to release a new app version if it changes again.

My question is: where is the best place to store sensitive information like API keys? Additionally, what other types of data can be stored online without compromising security?

I understand that no solution is perfect, but I want to make it as difficult as possible for the buggers to access this information.

 

[Alexander Stolte]

put the API-Key variable in Process_Globals sub and compile with Obfuscation

 

[DonManfred]

put the API-Key variable in Process_Globals sub and compile with Obfuscation

You think this is enough to ensure the token does not get "stolen"?

It is far easy to get them from the APK.

 

[Alexander Stolte]

You think this is enough to ensure the token does not get "stolen"?

It's the recommended way from @Erel

Alternative, store the api key inside a image:

Protect your application against copy and changes

This method uses the F5Steg and PackageUtils libraries from ProBundle. There's a demo available in the Play Store: https://play.google.com/store/apps/details?id=b4a.protecthw.flm The source code is attached to this message and is used as a reference in the following explanations. It will not...

www.b4x.com

 

[DonManfred]

Alternative

i do like this solution much more

 

[DonManfred]

It's the recommended way

It does make things a bit harder.
But not much in my opinion.

 

[Addo]

Without authentication it can be impossible to protect your encrypted data you may harden the process of fetching those keys but you wont prevent it!

In my opinion store your sensitive encrypted "keys or data" in a backend that you will connect and use later to authenticate who can receive those sensitive information..

 

[Alex_197]

Without authentication it can be impossible to protect your encrypted data you may harden the process of fetching those keys but you wont prevent it!

In my opinion store your sensitive encrypted "keys or data" in a backend that you will connect and use later to authenticate who can receive those sensitive information..

But what if traffic will be intercepted by the moddle man? I think that the data sent or received should be encrypted by itself even with https.

 

[Addo]

But what if traffic will be intercepted by the moddle man? I think that the data sent or received should be encrypted by itself even with https.

For sure sniffing is basic expectation during requesting any information through the network!
Whether using ssl or not..the idea ? is to cost the requester subscription fees to get access to this service! Although everything can be handled in the server side without sending the client side any thing or keys but authentication!!

Each request in that case will be handled in the server context and the client will expect only a replay with none sensitive data! Also you can create a log to each request used the sensitive key or token and when you fall in the sensitive data breach you will catch the one who leaked your data through decrypting his requests since you logged already his account information while using this sensitive data!
In the oop case using key to communicate with open Ai for his app clients!

Briefly a thief should break the window or crush the door to get in. which is your server in that case who keep those data needs to be broken or crushed.

 

[hibrid0]

The best place is in your server side.
Your app=>>your Backend=>>OpenIA.

And you will track the request and limit by hour or day.
Or ban an IP or device by Mac or Android Identifier.

 

[tsteward]

The best place is in your server side.
Your app=>>your Backend=>>OpenIA.

And you will track the request and limit by hour or day.
Or ban an IP or device by Mac or Android Identifier.

I'd love to see some code on how you are doing this if possible.

So in my app customer types info on a vehicle then presses the AI button which rephrases it for them.
Are you saying I should submit the users input to the server and then return the result instead of doing it on the device?

 

[Addo]

I'd love to see some code on how you are doing this if possible.

So in my app customer types info on a vehicle then presses the AI button which rephrases it for them.
Are you saying I should submit the users input to the server and then return the result instead of doing it on the device?

Use any communication protocol as a server and connect your app client to it..every thing will be running under this server context and your client app will be such a place to receive what ever you like.

 

[MrKim]

Use an encryption library.
Encrypt the key with a PW.
Store the encrypted key and the PW in your app in different places using misleading names.
Decrypt the key when you run the app.
Not bullet proof but will take someone some time to figure out.
You could also put the encrypted key and the password in external files then load them and unencrypt at run time.
You could also store them in unused tags on some of your layouts.

 

[asales]

I'm starting to use the OpenAI API in my apps, and due this thread (to avoid the same problem), I found this information:
"Never deploy your key in client-side environments like browsers or mobile apps."

https://help.openai.com/en/articles/5112595-best-practices-for-api-key-safety

So, I think, even you encrypt the key or download from the hosted database and use in your app, you will get a problem.

The recommended way is using a server to connect to OpenAI API and get the response:
"Requests should always be routed through your own backend server where you can keep your API key secure."