Is it safe to keep an API key in the app if it is obfuscated?

Encoding makes a key slower and costlier to recover, and Otukan does that for the values you keep. A value every copy of the app shares is still one determined analysis away from exposure. Treat shipped keys as identifiers that can be rotated, keep anything that authorises money or data on your server, and let the app earn short-lived tokens through attestation.

Can the Secure Enclave encrypt our app data?

Not directly. The Secure Enclave generates and holds elliptic-curve private keys and uses them for signing and key agreement; the key never leaves it. Bulk data is encrypted with a symmetric key in the normal way, and the Secure Enclave key can protect that symmetric key. Otukan builds on this model rather than presenting the enclave as a general encryption engine.

What happens to Keychain items when the app is deleted?

They can outlive the app, so a reinstall may find tokens from an earlier account. Plan for it: detect a fresh install, then clear or revalidate what you find. Otukan recognises that first launch and hands the decision to your policy, so a device changing hands does not inherit a session.

Do Keychain items move to a new iPhone?

That depends on the accessibility class. Items without the this-device-only suffix travel in encrypted backups and can arrive on a new device; this-device-only items and Secure Enclave keys stay behind. Choose the class per item, and give users a clear re-enrolment path for the keys that stay on the old phone.

Application security feature

iOS app secrets protection

How to protect embedded and runtime secrets in an iOS app: Otukan encodes shipped values, gates Keychain use on runtime risk and supports server-side rotation.

Discuss your encryption and key handling requirements Check your app's exposure

Sort before you protect
Public identifiers, shared app secrets and per-user credentials carry different risks, and each gets a different home and a different control.
Keychain used well
The right accessibility class, access group and access control for each item, with Secure Enclave keys where signing or key agreement fits.
Built to be replaced
Every shipped value can rotate in the next release, and short-lived tokens from your server do the real authorising.

Where iOS secrets leak and what Otukan does

Pick a leak path to see how Otukan finds the exposure, what changes in the app and what your team keeps.

Key readable in the binary

Detect
Otukan flags values in the build that look like credentials, such as API keys, tokens and private key material.
Respond
The values you keep in the app are encoded in the executable and decoded only at the moment of use.
Report
Your team receives a list of flagged values per build, so shared secrets can move to the server.

Secret in a bundled file

Detect
Property lists, JSON configuration and asset files are reviewed for embedded keys and endpoints.
Respond
Sensitive entries move into protected storage in the executable instead of plain files in the bundle.
Report
The build report shows which bundle files still hold values worth attention.

Keychain read by a hooked app

Detect
Otukan's runtime signals reveal hooking, debugging and jailbreak conditions before a protected item is read.
Respond
Reads of the items you mark are paused while those conditions persist.
Report
Your backend learns that a credential request was withheld and why.

Decoded value left in memory

Detect
Otukan knows every value it decodes for your code, and its runtime checks flag the debuggers and instrumentation tools used to read process memory.
Respond
Each value is cleared from memory once the calling code is done with it.
Report
Your team sees which values are handled this way in each build.

Stale items after reinstall

Detect
Otukan recognises the first launch of a fresh install, even when older Keychain items survived deletion.
Respond
Your policy decides whether leftover tokens are cleared or revalidated with the server.
Report
A reinstall event lets your backend re-bind the session to the new install.

What Otukan adds to iOS key handling

Platform storage does the heavy lifting; Otukan closes the gaps around it.

Embedded value encoding
Keeps shipped keys and endpoints out of plain view in the Mach-O executable until the moment your code needs them.
Secret discovery per build
Flags values in code and bundle files that look like credentials, before the build reaches App Store Connect.
Risk-gated Keychain access
Withholds the items you mark while jailbreak, debugger or hooking signals are active.
Short-lived plaintext
Clears decoded values from memory once used, narrowing the window for a memory read.
Fresh-install awareness
Recognises a reinstall so leftover Keychain items can be cleared or revalidated with your server.
Attested credential issuance
Pairs with App Attest so your server issues short-lived tokens only to your genuine app.

How it works

Inventory the values
List what the app ships with, what it receives at run time and where each is stored today.
Move what can move
Shift shared secrets to the server and plan short-lived tokens in their place.
Protect the rest
Otukan encodes remaining embedded values and adds risk gating to marked Keychain items.
Test the edge cases
Accept reinstall, restore from backup, new device and biometric change on physical iPhones.

Protect iOS app secrets by first sorting them, then giving each kind its own home. Values shipped in the app, such as API keys and endpoints, can be recovered by anyone patient enough to analyse the binary, so Otukan encodes the ones you keep and helps you move shared secrets to your server. Per-user credentials belong in the Keychain with the right accessibility class, and Otukan withholds the items you mark while the device or process looks compromised. Keys that sign or agree keys can live in the Secure Enclave. No app-side technique keeps an embedded secret hidden for good, so rotation and short-lived tokens finish the job.

The Android and cross-platform side of key handling is covered on mobile app secrets protection.

Hardcoded values versus user credentials

Most secret leaks start with putting a value in the wrong category. The table sets out the categories Otukan works with.

Kind of value	Examples	Where it should live	What Otukan adds
Public identifier	Analytics or map SDK keys limited by bundle ID	In the app, rotatable	Discovery, so you know it is there
Shared app secret	Request-signing keys, partner API secrets	On your server, replaced by tokens	Encoding for any value that must stay for now
Per-user credential	Refresh tokens, session keys	Keychain, this-device-only where possible	Risk-gated reads and reinstall awareness
Device-bound private key	Keys that sign transactions or bind the device	Secure Enclave	Runtime signals before each signing request

The rule of thumb: if every copy of the app holds the same value, assume it will be found. Otukan’s build report lists the values that look like credentials so your team can decide which ones to move.

Keychain and key-access responsibilities

What iOS gives you

The Keychain encrypts items at rest and ties them to your team through access groups, which is also how the app shares items with its extensions. Accessibility classes decide when an item can be read, for example only while the device is unlocked, and whether it may leave the device in a backup. Access control flags can require a passcode or current biometric enrolment, so an item stops opening when someone adds a new fingerprint or face.

What stays your responsibility

Choose the accessibility class per item rather than one default for the app.
Keep extensions in a shared access group only when they need the item.
Encrypt large data with a symmetric key and protect that key, instead of storing bulk data as Keychain items.
Treat the Secure Enclave as a place for signing and key-agreement keys, not general storage.

What Otukan adds

The Keychain assumes the app asking for an item is the genuine, unmodified one. On a jailbroken device with hooks in place, that assumption no longer holds. Otukan checks for those conditions before a marked item is read and pauses the read while they last. Data encryption practice is covered on iOS app data encryption.

Rotation, reinstall, backup and runtime limits

Rotation

Design every embedded value to be replaceable in the next release, and prefer credentials your server issues for minutes or hours. Paired with App Attest, your backend can hand those tokens only to a genuine copy of the app.

Reinstall and backup

Keychain items can survive app deletion, and items without the this-device-only suffix can reach a new phone through an encrypted backup. Otukan recognises a fresh install so your policy can clear or revalidate what it finds, and your team decides which items may travel.

Runtime limits

A secret has to exist in plain form while it is used. Otukan narrows that window by decoding values only when called and clearing them afterwards, and memory detail is covered on iOS app memory protection.

Testing the edge cases

Acceptance runs on physical devices with the distribution-signed build: attempt to read marked items under a lab jailbreak and hooks, repeat the flow on a clean device, then test reinstall, restore, migration to a new iPhone and a biometric change. Versions, results and the reviewer are recorded. Step-by-step iOS material is in iOS app security guides.

The rest of Otukan’s iOS protection is on iOS app security. The free App Exposure Check works from your public App Store release, and we never ask you for the secrets themselves.

Common questions

Is it safe to keep an API key in the app if it is obfuscated?
Encoding makes a key slower and costlier to recover, and Otukan does that for the values you keep. A value every copy of the app shares is still one determined analysis away from exposure. Treat shipped keys as identifiers that can be rotated, keep anything that authorises money or data on your server, and let the app earn short-lived tokens through attestation.
Can the Secure Enclave encrypt our app data?
Not directly. The Secure Enclave generates and holds elliptic-curve private keys and uses them for signing and key agreement; the key never leaves it. Bulk data is encrypted with a symmetric key in the normal way, and the Secure Enclave key can protect that symmetric key. Otukan builds on this model rather than presenting the enclave as a general encryption engine.
What happens to Keychain items when the app is deleted?
They can outlive the app, so a reinstall may find tokens from an earlier account. Plan for it: detect a fresh install, then clear or revalidate what you find. Otukan recognises that first launch and hands the decision to your policy, so a device changing hands does not inherit a session.
Do Keychain items move to a new iPhone?
That depends on the accessibility class. Items without the this-device-only suffix travel in encrypted backups and can arrive on a new device; this-device-only items and Secure Enclave keys stay behind. Choose the class per item, and give users a clear re-enrolment path for the keys that stay on the old phone.

On the mobile engineering team?

How protection fits your build, signing and release, platform by platform.

Make your shipped secrets hard to lift

Tell us what kinds of values the app ships with, how it stores tokens and keys today, whether extensions share them and how your backend issues credentials. We never ask you to send the secrets themselves, source code, IPA files or signing certificates.

Discuss your encryption and key handling requirements Get a free app exposure check

Or request a technical demo

iOS app secrets protection

Sort before you protect

Keychain used well

Built to be replaced

Where iOS secrets leak and what Otukan does

What Otukan adds to iOS key handling

Embedded value encoding

Secret discovery per build

Risk-gated Keychain access

Short-lived plaintext

Fresh-install awareness

Attested credential issuance