I read a lot that you can't restrict your Public REST API to only your mobile application, but I have an idea and I want opinions on it:
Variable App Key Method
- Get IP address of current connection
- Use a secret algorithm to generate a hashed AppKey from IP address.
- Send the AppKey with each API request
- Check the IP address of incoming request
- Generate AuthKey from that IP address using same secret algorithm.
- Compare AuthKey with AppKey, if they match then you know that your Application is talking to you, because only the application knows the secret algorithm.
When IP address changes:
- On mobile App regenerate the AppKey using the new IP address
- Server side will always generate same key because it depends on IP address of the request
The main advantage of this is that the AppKey will always change, which is better than hardcoding 1 application key inside the code, which can be easily stolen by reading request headers. And even if you stole the AppKey from a user you must be using the same IP address where that key was generated.
Relying on the IP address is problematic because you will need to call an external API to return back your correct IP address, and you will have to do that before every request because IP addresses change all the time.
Second problem is that internet connection on mobile switches a lot from WiFi to 3G to 4G, which will lead to unstable application behavior.