Secure API Keys with a Public-Key Cryptography on Android

Store API Keys on a Backend Server and exchange them Securely with Andorid app, with the help of Android Keystore System

In this short-length course I will teach you how to securely store API keys in your Android App, without exposing them to the public. With the help of a Public Key Cryptography, Android Keystore System, Encrypted Shared Preferences and our own Backend server, you will achieve exactly that.

Public key cryptography, also known as asymmetric cryptography, is a cryptographic approach that uses key pair: public key and private key. Each key pair consists of a public key and a private key that are mathematically related but cannot be derived one from another.

This approach will help us to securely exchange the data between a client and a server. API Keys will be initially stored securely on our backend Server. The server and the client will exchange the public key, to encrypt the data, before sending it back to the client.

That way we can make sure that no one can read the actual data which is exchanged. Only our Android application will hold the private key to decrypt the data, and securely  store the API keys on a device.

Android Keystore system is a part of the Android operating system that provides a secure storage facility for cryptographic keys, certificates, and related information. It is designed to protect sensitive data, such as private keys used for encryption and authentication, from unauthorized access.

I will provide you with some more detailed information about the Keystore System itself and how does it work. We will utilize that system to securely store the Public Key Pair that is going to be generated for us.

So what are you waiting for, let's get started!