Your vendor may have Terms of Service or legal contracts that prevent you from building an 'aggregation service' or proxy, so you need to check with that.Įven if your key doesn't get compromised, if one of your customers is doing something that causes the vendor to block your key, suddenly ALL your customers are disabled, and your only fix is to update everybody else. The thing to keep in mind here is that you may not be allowed to do this.

Your own API key system where you can issue keys to your customers.

Some existing licensing/authorization mechanism you already have for your servers.

making the functionality so specific nothing but your app can use it.

You may need additional protection on your API, eg, something to ensure only your application is using it. Set up a proxy API, where your application calls your API (on your servers), and in turn, your API calls the vendor's API using the key. In fact, many vendors that issue API keys contractually require you do things this way, so you may even be off on the wrong path anyway, and this may be the only solution you're allowed to use according to the vendor's Terms of Service and/or any legal contracts you may have with them.

The software merely has a configuration option to set the Google Maps API key to use. The creator of the software has their own key they use while developing/running their copy, but they do not include it in the software, and instead, require you, as the user installing said software, to go to Google and obtain your own API key. This is actually quite common with, for example, products that use Google Maps API. This would require some additional relationship with the vendor, where you can obtain keys or have your customers obtain keys. I can see two primary ways to accomplish this, both of which don't include your private API key in your deployed application: Get a unique API key for each deployment

Likewise, if someone can intercept traffic, they can capture the API key ( potentially even if you're using SSL). Ultimately, if the binaries are out of your control, everything in them is out of your control. This means it should never be deployed on a server where anyone besides you could read the binary, and never go over a communication link you don't control. The best way to prevent compromise of this key is to keep control of it.

You are deploying the application to systems where customers have access to the binaries and thus could potentially decompile/deobfuscate the code or intercept traffic.

You are making calls to that vendor's API (which require the API key) in your application code.

You have an API key issued to you by a vendor so you can use their API, and you have an obligation to prevent this key from being known by anyone else.

Hide all ip license key 2019