1

I am using Retrofit2 for API calls via my Android app:

Api api = new Retrofit.Builder()
            .baseUrl(BASE_URL) //<-- Problem here
            .addConverterFactory(GsonConverterFactory.create(gson))
            .client(okHttpClient.build())
            .build()
            .create(Api.class);

Nowadays, many apps are being re-uploaded to the store by just changing the BASE_URL needed or with some minimal re-skinning. I know that protecting to 100% an app from Reverse Engineering is impossible, but I just want to somehow make it harder for anyone to just change the BASE_URL and use the app with his own API.

For the BASE_URL itself, I am getting it with some native code as explained here. But still, anyone can put whatever he/she wants in baseUrl(BASE_URL) and he/she is good to go.

For now, I am thinking to import the whole Retrofit2 as a module in my project and modify there to add some level of obscurity.

But I am just wandering, isn't there any better way to do it?

Thanks.

hiddeneyes02
  • 2,562
  • 1
  • 31
  • 58

0 Answers0