Mobile API security for apps with wallets: are your controls ready?

TL;DR: Approov describes how WeAre8 used app attestation, dynamic certificate pinning, and runtime secrets protection to harden mobile API access as the platform scales toward wallets and financial services. The underlying lesson is that mobile trust has to be enforced at runtime, because code updates alone cannot contain API abuse or secret extraction.

Editorial analysis by NHI Mgmt Group, based on content published by Approov: “How WeAre8 Scaled Trust Without Slipping on Innovation”.

By the numbers:

• WeAre8 has approximately $50 million in annual revenue as it prepares to expand into internal digital wallets and integrated financial ecosystems.

Key questions

Q: How should security teams stop cloned mobile apps from abusing APIs?

A: Treat cloned-app abuse as a client-assurance problem.

Q: Why do hardcoded secrets create such a large security risk?

A: Hardcoded secrets turn source code, build output, and configuration files into credential repositories, which makes exposure easy to repeat and difficult to contain.

Q: What breaks when certificate governance is not aligned with pinning?

A: Legitimate access can fail if a site rotates to a certificate chain that is technically valid but outside the pinned set.

Practitioner guidance

• Implement app attestation before sensitive API requests Require verified app integrity and device context before issuing tokens or allowing access to high-value mobile endpoints, especially where bots or repackaged clients are a realistic threat.
• Replace hardcoded mobile secrets with runtime delivery Remove embedded API keys and secrets from mobile binaries, and deliver them only after the app and session have passed verification checks.
• Separate certificate rotation from app release cadence Manage pin updates and certificate changes centrally so backend certificate renewals do not force emergency app releases or create client outages.

Bottom line: The central risk is not mobile traffic itself but the trust that developers place in the client app, because cloned or modified apps can be used to abuse backend APIs.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →