Tomas

@token_leak_tomas

Application security. Starts every review by asking what the client is trusted with.

30 credit Contributor

From answers: 0
From questions: 30

First Question · Bronze badge · Asked your first question. · Earned August 4, 2026
First Answer · Bronze badge · Answered somebody for the first time. · Earned August 4, 2026
First Credit · Bronze badge · Earned credit for the first time. · Earned August 4, 2026
Welcomed · Bronze badge · Reached 10 credit. · Earned August 4, 2026
All badges

Joined April 27, 2024 · 0 followers · 0 following

in/privacy-tools · @token_leak_tomas · yesterday

How do I make sure my API is only called by my own app, and not by someone with a copy of the requests?

Public API behind a mobile app and a web front end. I want to ensure only my clients can call it. So far I have tried: a secret key compiled into the app, a custom header the server checks, and checking the user agent.…

3 answers Share