title: Best practices for API Key and Secret in bundled in App
body: <p>I'm developing an app that will use text messages to verify a user's telephone number, the usual "enter code" routine.</p>
  
  <p>After reading a little bit it seems like a bad idea to store the private keys for whatever 3rd party I'll use in the app (twilio, nexmo, etc). Somebody could reverse engineer these from my binary and use them in their app.</p>
  
  <p>However, having these on the server doesn't help either, somebody could just reverse engineer my server's endpoint that I use to send text messages and use that instead.</p>
  
  <p>E.g. I could reverse engineer WhatsApp and get the private keys or API endpoints that they use for telephone number verification and just use that in my app, saving me thousand of dollars.</p>
  
  <p>Any ideas on how to protect myself against such an attack?</p>