How do I mock API responses with security in mind?

Question

My team and I are beginning to mock our API responses in our iOS app so we don't have to worry about our backend being up when testing.

I have conditional compilation directives based on the SWIFT_ACTIVE_COMPILATION_CONDITIONS flag, specifically DEBUG MOCK_SYSTEM. This flag controls whether my code uses mock data or sends real network requests. While it works, I'm concerned about the security of exposing confidential non-production API keys in the development and testing process.

#if MOCK_SYSTEM
        DispatchQueue.main.asyncAfter(deadline: .now() + mockRequestDelay) {
            completion(.success(MOCK.accountCreateResponse))
        }
#else
        sendWLRequest(
            request: .postAccountCreate,
            body: account.toBodyString(),
            firebaseAnalyticsCategory: .enrollmentApiError,
            additionalRequestSettings: { request in
                request.timeoutInterval = NetworkService.Timeout.enrollment.value
                request.setJsonAsContentType()
            },
            completion: internalCompletion
        )
#endif

I'm using #if MOCK_SYSTEM to conditionally execute code for mock responses or real network requests. The code snippet I provided is just one example, but I have multiple instances of this pattern throughout my codebase. My primary concern is that during development and testing, confidential non-production API keys are embedded in the code when using the MOCK_SYSTEM flag. These non-production API keys are sensitive and should not be exposed outside of the development and testing environments. While I want to maintain the ability to switch between mock and real requests for testing and development purposes, I'm looking for a more secure and organized way to handle this.

How can I securely manage conditional compilation in Swift code with a DEBUG MOCK_SYSTEM flag while ensuring that confidential non-production API keys are not exposed in the development and testing process?

Are there security best practices or tools for handling sensitive configuration data, such as API keys, in development and testing environments?

Is there a design pattern or architecture that can help centralize this behavior without exposing confidential non-production API keys in the codebase?

Are there Swift libraries or tools that can simplify the management of mock data and real network requests while addressing the security concern related to confidential API keys?

I'm looking for guidance on how to refactor this code to make it more secure, maintainable, and organized while addressing my concern about exposing confidential non-production API keys. Any advice, recommended practices, or tools would be greatly appreciated. Thank you!

Answer 1

Rather than sprinkle such conditionals throughout your program, refactor the code so that all communication goes through a single, minimal communications specialist. Then replace that specialist with an even simpler pseudo-communicator when testing.

In other words, use dependency injection - this is exactly what it's for.