I am currently working on a project where I am developing a library which will do HTTP POSTs to a backend service on my server. The data that the backend service receives is processed and stored in a database and allows the user using the library to see the data.
I want to ensure that the backend service only processes requests from the library, if anything else tries, such as bots etc, the request is rejected.
I was thinking I could achieve this by the library sending an encrypted string in a header in the HTTP request, then when the backend services receives the request, it checks if the header exists and if not rejects the request, if it does, it decrypts the header and then checks if the decrypted string matches what the backend service expected, if so, continues processing, otherwise rejects it.
I was thinking that the library could have the validation token hard coded in the library (the library won't be open sourced) however, I was thinking that this could be problematic if the validation token ever gets compromised, I would need to release a new library version with the new token, and anyone using the library, would then need to update their apps to use the new library.
I was then thinkin the token could be stored on the server and the library requests what the token is and then sends the token to the backend service, but I then have the same problem I'm trying to avoid, how do I make sure only the library retrieves the token and not anyone else.
Is there a recommended best practice for doing what I am trying to achieve.
Thanks for any help you can provide.