.NET MAUI › Security & Authentication

How do you protect API keys and secrets that the app needs?

Advanced

Answer

Avoid shipping high-value secrets in the app at all—proxy calls through your backend so the key never reaches the device. If a key must be present (e.g., a public client id), scope it minimally and restrict it by platform/app signature at the provider. Obfuscation and SecureStorage help but don't make an embedded secret truly safe.

// Preferred: app -> your backend (holds the secret) -> third-party API
var data = await _myApi.GetProxiedAsync();   // no third-party key on device

Real-world example Instead of embedding a payments provider secret, the app calls its own backend which holds the key server-side.

Common follow-ups: Why can't embedded secrets be fully secured? | How do you restrict a public key?

Security Networking & APIs Security & Authentication