How allow to request my API only by my mobile app?

Question

I have developed an API restful in JSON to retrieve data from my server by a mobile app (iOS). I want to keep hidden my API avoiding someone via a network sniffing tool (like Wireshark) could find out it. On my server how can I allow only http request from my mobile app? What can I do?

Keep in mind that anything accessible to a client system (be it an iOS app or a a web app) it can be reverse engineered. You can make it difficult but there are many smart people with too much free time on their hands. — abraham
– abraham, Commented Feb 1, 2012 at 2:15

Moshe · Accepted Answer · 2012-02-01 01:50:04Z

5

Use SSL and an API token.

Essentially, your request is going to contain your API token or key as a part of the request payload. You can encrypt the data yourself, using SSL, or both.

On the server, you check that the token matches with what is a valid token.

edited Feb 1, 2012 at 1:50

answered Feb 1, 2012 at 1:41

Moshe

58.2k81 gold badges278 silver badges432 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

How allow to request my API only by my mobile app?

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related