We all know that we shouldn’t store secrets in mobile apps, but what is the practical alternative? We all know that we should use certificate pinning for our APIs, but how can it be done simply and safely? This talk will describe a real project to explore some of the challenges of implementing good security practice in a large organization and discuss a third-party solution (Approov) which addresses both of the issues above in a relatively simple way using industry standards and working neatly with Kong.