title: Securing private API key
body: <p>So I've been searching a while about this whole private API keys security and I'm kind of confused about the approach I should take simply because I haven't found yet someone with the same particular issue/approach than mine is.</p>
  
  <p>I'm developing an Android app that works through a third-party API which I gained access by requesting a private key. Now, 2 points:</p>
  
  <ul>
  <li>my app doesn't request directly to the API I'm using, instead, it requests to a set of PHP files (hosted on the app website) I coded to simplify the requests and retrieved data from the API I'm using, lets call it a "sort of API", if you allow so. So, from the app only requests specifying what my sort of API should request to the original API are sent, and, in consequence of this, the requests doesn't need the original API private key, because I can store it in one of the php files and use when needed. </li>
  <li>my app doesn't require the users to register their accounts, so I don't have any user IDs or names to work with in requesting.</li>
  </ul>
  
  <p>So, from this you can see that I'm not trying to hide the API key in the app code neither I'm trying to use user ids and signatures to allow access to my sort of API and consecutively to the original API.. </p>
  
  <p>The thing is that despite of the fact that php code cannot be seen in the browser, it isn't impossible to do so in other manners, so I'm not secure in storing my key there either. So my question is simple, is this still the best approach for me to use to hide my private API Key or should I re-think the way I doing all this process?</p>