0

I am writing software which accesses a third-party library. Their API requires a key which is tied to my application. I do not want to put the key in application's code, because I do not want others to have access to it. So I want to put it on a server. The application talks to the server, which has the key, and the server talks to the third-party library.

I do not want to have to write this server. This seems like a common thing. Are there any existing products that server this purpose? What is a tool that I can tell my API key ahead of time, and then it will approve any of my API requests given a less-secret key?

I was thinking AWS may have a product like this, but I could not find the one I am looking for. AWS Gateway seemed promising, but that looks like it was more about building APIs than accessing them.

Some background: It is about an app that runs on the client, which runs on cross-platform mobile. It currently polls the third-party API directly, and includes the application-wide secret key on the client. So anyone can steal the key for my entire application. So as I understand, I need a server between the client and the third-party. I just did not want to have to build that server myself for something so simple. I was guessing that AWS had something that suits my need, but I do not know which it would be among their massive list of products.

Improve this question
  • To me this looks like a very common use-case for a config file or database record your software could look up. What speaks against such a simple solution? Maybe I have missed some point. – Izzy♦ Jul 11 '17 at 16:29
  • @Izzy Where would I store that config file? I just need secure access to a few constant strings. Is making a database for this not overkill? – Evorlor Jul 11 '17 at 16:35
  • Whether a database is overkill depends: if you already have a database running for other purposes, all you'd need is a table in there. A config file of course is easier – and must be put where the software can "reach" it. Hard to tell without further details; on a *nix machine you could place the config in eg. /usr/local/etc or simply /etc (which is outside your software location). On Windows I don't know where I'd place it. Question is also if the software runs on a machine under your control, or e.g. on a customers machine. – Izzy♦ Jul 11 '17 at 16:41
  • @Izzy There is currently no database existing. It is just an app that runs on the client. It currently polls the third-party API directly, and includes the application-wide secret key on the client. So anyone can steal the key for my entire application. It runs on cross-platform mobile. So as I understand, I need a server between the client and the third-party. I just did not want to have to build that server myself for something so simple. I was guessing that AWS had something that suits my need, but I do not know which it would be among their massive list of products. – Evorlor Jul 11 '17 at 16:47
  • 1
    That were some very useful details, Evorlor – I've integrated them with your question. So hopefully some mobile developer can help you out. Good luck! – Izzy♦ Jul 11 '17 at 21:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.