title: Hide API key from 3rd party?
body: <p>The iPhone app that I am working on requires GET calls to a 3rd party site's api. The 3d part site does not offer SSL and requires the API key be in the GET request's querystring. What is the best way to secure this? I know I can have the iPhone app talk to my server and then my server send a request but I would like to avoid that if possible. The other question is if this is even a big deal. What can they do with the API key anyway if it is only pulling data?</p>