Great question — answering as the UphillTech team:
Your Problem They provide me with an API token which I use to make the API calls from my android mobile app (react native) I know it is a bad practice to store this API token on the mobile client because attackers might still it and use my quota and money. Yes, its indeed a very bad practice, but at least you are aware of the risks, while a lot use this approach without realising how easy its for an attacker to grab such secrets (Api tokens, API Keys, whatever you name them). In a series of articles I wrote on Mobile API Security I show how easy it can be done with static analyses and with a MitM attack: How to Extract an API key from a Mobile App with Static Binary Analysis : The range of...
Full answer by Exadra37: https://stackoverflow.stackexchange.com/a/75109966 (CC BY-SA 4.0).
Want it for your business? UphillTech.