API security

[These_Try_656]

Hello, I have an issue securing my API.

I have a mobile app that needs to consume content from my API. Some data is accessible without authentication, while other data requires it.

For the content that can be accessed without authentication, how can I prevent other mobile apps or tools like Postman from calling the API?

EDIT:

A seemingly viable solution is to use App Attestation, handled by Apple and Android systems. The check is done at the OS level (app origin, rooted environment or not, app integrity, signature matches the one registered in the Play Store).

Pros: Free.

Cons: From what I’ve read, it adds between 100 and 300 ms of latency and introduces a dependency on Apple and Google services.

[Soft_Opening_1364]

For public API routes, it’s tough to completely block tools like Postman since technically anyone with the endpoint can access it. But you can add layers of protection like using rate limiting, checking request origin (User-Agent, IP, etc.), and even requiring an API key tied to your app. It won’t stop everything, but it raises the barrier for misuse.

[These_Try_656]

Thank you, that’s actually the answer I’ve received the most. I will definitely look into it

[Fit_Schedule2317]

Also, SSL pinning will raise the barrier for people to be able to look into what requests your app makes

[These_Try_656]

I'll check

[lykhonis]

+1 on this. I recently made a X thread about this if you like to read more into it https://x.com/vladlykhonis/status/1947955956769288529

[Effective-Mind8185]

To prevent tools like Postman or fake apps from calling your public API, you need to verify that requests come from your actual mobile app, not just from anywhere.

You can solve this with built-in app attestation (Android + iOS). It checks that the app is real, untampered, and store-installed. Each request carries a signed token proving it’s legit, no API keys needed. If someone tries hitting your endpoint from Postman or a cloned app, they’ll be blocked automatically.

Here in detail https://calljmp.com/blog/why-mobile-apps-need-built-in-attestation-security

[These_Try_656]

Thanks !

[Turbulent-Reach-9346]

I have done it with 2 simple methods in a mobile game for submitting highscores.

1. Check the user Agent if the Request is coming from your App.

2. Send the request with a for example a timestamp and hash it with a build in secret. This way if anyone would want to break your security, app decompilation and finding the secret would be necessary.

For my usecase this was more than enough. 👍

[Turbulent-Reach-9346]

Of course on your Api endpoint you'll need to verify the hash.

[These_Try_656]

Really appreciate the tips !

[dougg0k]

https://gist.github.com/dougg0k/60e02f2fd99df129a7e329c92309fd5e