Difference between Storefront access token and API Key

[pd3]

I am trying to use Buy IOS SDK for a mobile app to access my test Shopify store. From another Q&A on this forum I realized I needed to setup a private store, which I did.

In the admin I can see that there is a API Key(labelled as private) as well as store front access token(labelled as public) available. What is the difference between the 2 and what am I expected to use in the Buy IOS SDK. I would imagine it would be the private key, but that puts me in the situation of having to store the private key on my app(which is not exactly secure). 

[pd3 · Accepted solution]

https://community.shopify.com/c/Storefront-API-SDKs/Read-Before-Posting-Custom-Storefront-Storefront...

This states:

• The Storefront API is an unauthenticated API and access is managed by scopes
• For a private app, you will utilize the storefront access token from the Admin. This is different from the API Key and Password used for the Admin API