android - Mobile APP - API Authentication concept -

i have conceptual question , wanted know if kind enough help.

i use simple example explain point of view.

i have developed simple restful api node.js + express + mongodb backend. api saves hightscores android game app. use token-based authentication, tokens generated secret , trusted username/password (hardcoded or not).

but still have doubt thinking safety...

reverse engineering piece of cake since developer can find backend endpoint of api , use username , password (or hardcoded one) obtain token.

then token ca used insert fake highscores via api.

my questions are:

• is there way avoid security hole?
• is using restfull api correct way connect mobile app backend in server?
• if not, correct way develop app-server comunication save data in backend db?.

i think can ofuscate code includes hardcoded username , password dont solve situation.

pd: users question broad. made 3 concrete questions , topic avoid visibility of app information connect api. know there answers, dont want solution, way investigate.

there no full-proof way this. in theory, can debugged - including verification mechanism (token generation).

using web api way have mobile app communicate backend , works fine in cases. however, case, want make sure api used via android app have. typically done encrypting communication protocol , making hard others debug it. so, app encrypt communication in way, hard decrypt if don't know internals of app/server. however, hard scratch.

if want ready-made solution, use google's play game services, highscores, achievements, etc. should secure enough, can't implications current situation.