How can I secure my data in Unity?

Question

I have a tenant ID and client secret that I use to access my server and return an API key for users. I put it in start()

However, hackers can decompile my game and access the server data. Is there any way to secure my tenant ID and client secret in my client code?

Answer 1

What is in clients hand is by definition not secret anymore. Regardless what you do, if they are dedicated enough they can get the information that is located inside the client.

Instead why not let the client authenticate itself against the server and let the client just ask for the data? The server would not hand out the api key to the user but the result of the request that the client would make. This has some further benefits:

• You can cache the results in case multiple clients make often the same requests
• You know and can control which client is calling how often the endpoint
• If data manipulation is needed (the return data from the endpoint), you can do this on the backend out of clients sight. In case of huge data this can save the client computation power. It could be a legal requirement. Or you can enrich the data. Or restructure to fit better your client.
• People just can't take apart your client to recreate your app since the business logic (handling of endpoints, secrets) is not located in the client.