title: REST API authentication for mobile application iOS and Android
body: <p>I want to securely access the REST API(.net) through a mobile application(react-native). I had the following solutions but each one has its drawback. Can someone suggest me the solution to the problem?</p>
  
  <p><strong>1.</strong></p>
  
  <p>REST API: secure rest API with username &amp; password.</p>
  
  <p>Mobile App: send username and password with every rest API call. </p>
  
  <p><strong>Drawback</strong>:
  On reverse engineering username and password is obtained which is stored in the mobile application. The code was obfuscated and password was stored at places but hackers were successful to obtain password after doing certain efforts. </p>
  
  <p><strong>2.</strong></p>
  
  <p>REST API: auth 2 implemented </p>
  
  <p>Mobile App: call Rest API to obtain Token for future use but the first time required to pass auth credentials to obtain token. Same problem username &amp; password can be obtained by reverse engineering. </p>
  
  <p>How we can move app secrets out of the app and can access REST API securely from the mobile application?</p>