# Your Mobile App Is Leaking Its API Key

> It's hardcoded inside the app — anyone can unzip it and read it.

- **Format:** short video, 8 steps, ~26 seconds
- **Topic:** Why an API key shipped inside a mobile app is already public — an APK is a zip file — and how moving it behind your own API into Azure Key Vault takes it off the phone entirely.
- **Author:** Suthahar Jegatheesan (MSDEVBUILD)
- **Category:** Azure · Azure Security
- **Published:** 2026-08-21
- **Tags:** azure, security, azurekeyvault, mobilesecurity, appsec, android, dotnet, dotnetmaui, apisecurity, cloudsecurity, devsecops, microsoftazure, backenddeveloper, msdevbuild
- **Canonical URL:** https://blog.msdevbuild.com/shorts/mobile-secret-in-apk/

---
## What you'll learn

- Why an app package is public the moment you upload it to a store
- Why a key inside the app is already leaked, before anyone looks
- How Azure Key Vault behind your own API keeps the key off the phone

## Understand it one step at a time

### 1. Your app calls Azure directly

To do that, it has to carry the key in memory at the moment it’s used — which is exactly what makes it recoverable from the package.

### 2. An APK is a zip file

Rename it, extract it, and apktool or jadx turn the compiled classes back into readable Java or Kotlin in about a minute.

### 3. One search finds the key

It’s sitting in strings.xml or Info.plist in plain text — no exploit involved, this is the file you published.

### 4. Azure cannot tell him from you

There’s no second identity to check. Same key, same permissions — his calls and yours look identical on the bill.

### 5. Put your API in the middle

The phone never holds a credential for Azure again — it carries a token for your API, and only your API holds the key.

### 6. The key moves to Key Vault

AddAzureKeyVault plus DefaultAzureCredential — the API’s managed identity reads the secret at startup, never hard-coded.

### 7. He unzips it again

Same apktool command, same minute of work — and this time the package has nothing worth taking.

### 8. If it ships, it is public

Obfuscation doesn’t change this: if the phone can read it to use it, so can whoever is holding the phone.

---

## The takeaway

**If it ships, it is public.**

Put your own API in front, keep the key in Azure Key Vault, and the app becomes worthless to unzip.