How Can I Secure My Windy Map API Key in a Mobile App (Free Version)?
-
I'm currently developing a mobile app and using the free Windy Map API to display the wind map using a WebView. As required, I include the API key in the windyInit({ key: '...' }) call within the HTML.
My concern is that this exposes the API key in the app, making it accessible to anyone who inspects the WebView or decompiles the app.
I noticed that Windy offers domain-based restrictions in the API key settings. However, since this is a mobile app, I’m unsure if those restrictions work reliably — WebViews often load local files or don’t send standard referer headers, so domain checking may not apply or protect the key in this context.
My questions:
Are there any official or recommended ways to secure the API key when using Windy Map API in mobile apps?
Does the premium version offer more secure methods of authentication or key protection?
Is domain restriction the only security option available for API key protection when using the free version?
Any insight from the Windy team or other developers with experience using the API in mobile environments would be really helpful. Thank you in advance. -
I idefix37 marked this topic as a regular topic on
-
@youssefchajia62 Unfortunately, this must be done by the developer, who implements our API. There is no official support for this right now.
