How ProtectMyAPI Works

ProtectMyAPI is a secure API proxy that protects your mobile app’s API keys using hardware-backed device attestation. Your API keys never touch the device, and every request is cryptographically verified to come from your legitimate app.

The Security Problem

When you embed API keys in your mobile app:

❌ Your App Code
├── Contains: API_KEY = "sk-abc123..."
├── Hackers decompile your app → Find the key
├── Bots use your key → Run up your bill
└── You get banned from OpenAI/Stripe/etc.

This happens constantly. Even obfuscation and encryption can be defeated by determined attackers.

The ProtectMyAPI Solution

✅ With ProtectMyAPI
├── Your App Code → Contains only App Token (not secret)
├── API keys stored on ProtectMyAPI servers (encrypted)
├── Every request verified with Apple/Google
└── Only YOUR app on REAL devices can use your keys

How Requests Flow

┌─────────────────┐         ┌─────────────────┐         ┌─────────────────┐
│   Your App      │         │   ProtectMyAPI  │         │   API Provider  │
│  (iOS/Android)  │         │     Servers     │         │ (OpenAI, etc.)  │
└────────┬────────┘         └────────┬────────┘         └────────┬────────┘
         │                           │                           │
         │ 1. Request + Attestation  │                           │
         │ ─────────────────────────>│                           │
         │                           │                           │
         │                           │ 2. Verify with Apple/Google
         │                           │ ◄────────────────────────►│
         │                           │                           │
         │                           │ 3. Inject API key         │
         │                           │ ─────────────────────────>│
         │                           │                           │
         │                           │ 4. Receive response       │
         │                           │ <─────────────────────────│
         │                           │                           │
         │ 5. Return to app          │                           │
         │ <─────────────────────────│                           │

Step by Step:

1. Your app makes a request → SDK adds cryptographic proof from the device’s secure hardware
2. ProtectMyAPI verifies the attestation → Apple (App Attest) or Google (Play Integrity) confirms:
   • ✅ This is YOUR app (not a fake)
   • ✅ Running on a REAL device (not emulator)
   • ✅ Device is NOT jailbroken/rooted
   • ✅ App hasn’t been tampered with
3. API key injected server-side → Your secret key is added to the request
4. Request forwarded → ProtectMyAPI calls OpenAI/Stripe/etc. on your behalf
5. Response returned → Your app gets the result (key never exposed)

Device Attestation Explained

iOS: Apple App Attest

App Attest uses the Secure Enclave — a dedicated security chip in every iPhone/iPad that:

• Generates cryptographic keys that can’t be extracted
• Signs requests proving they came from your legitimate app
• Apple validates these signatures on their servers

// What happens behind the scenes:
let attestation = SecureEnclave.generateAttestation(
    bundleId: "com.yourcompany.app",
    teamId: "ABCD1234",
    challenge: serverChallenge
)
// Apple cryptographically signs this, proving authenticity

Android: Google Play Integrity

Play Integrity uses TEE (Trusted Execution Environment) or StrongBox hardware to:

• Verify the device hasn’t been tampered with
• Confirm your app was installed from Google Play
• Sign requests with hardware-backed keys

// What happens behind the scenes:
val integrityToken = PlayIntegrity.requestIntegrityToken(
    packageName = "com.yourcompany.app",
    nonce = serverChallenge
)
// Google validates device integrity and app authenticity

What Gets Blocked

Security Layers

ProtectMyAPI uses defense in depth with multiple security layers:

Layer 1: Device Attestation

• Apple App Attest (iOS)
• Google Play Integrity (Android)
• Hardware-backed cryptographic proof

Layer 2: Request Signing

• Every request signed with device-specific key
• Timestamps prevent replay attacks
• HMAC-SHA256 signatures

Layer 3: Transport Security

• TLS 1.3 encryption
• Certificate pinning
• No downgrade attacks

Layer 4: Server-Side Protection

• API keys encrypted at rest (AES-256)
• Rate limiting per device
• Anomaly detection
• Audit logging

Why Trust ProtectMyAPI?

Performance Impact

Comparison: With vs Without ProtectMyAPI

Next Steps