It seems you have a fairly standard use case and you don't have a lot of experience with API's. In that case it might make sense to use one of the available frameworks which supplies you an API so you can focus on the business requirements. It also looks like a safer way to go and will give you some experience on possible implementations.
The security issue you have seems to be: I only want to receive requests from the real app / device. Correct?
That issue is about unsolvable unless you have full control over the devices.
If you have full control (like custom devices / MDM managed devices):
Install a certificate or some other security key on the devices and only allow access when they have a valid certificate.
Normal situation (smartphones, tables etc):
Don't base your security on the device itself but the user logged in (credentials). You generally don't care too much about the device a user is using. You care about the right user getting the right permissions.
What is REST in this context?
Your POST to the server has some things in need of definition: Which url do you send it to? What format of data do you send (JSON/XML/POST/etc)? How do you respond? What do you send when an error happens?
All those questions are (tried) to be answered by REST. So you use an industry standard to work with it.
A famous alternative is SOAP, so you can find some things to compare REST with.
So the implementation most likely:
Create the API with a tool (Zend Framework, CakePHP, Laravel, etc) which helps you to setup an api quite quickly. From that point you can accept the POST request.
Implement a security schema, most of the tools have some default solutions built in. So your POST contains a username + password OR some API security key.
You implement the business logic. You get the raw data (like JSON from the POST) automatically converted into some kind of native type like an object or array so you can use it straight away.
You can use the framework as well to answer in the right format or to raise errors when needed. It will send them back to your client in the right expected format.