http post API请求是如何来自我的应用程序的？

Question

I run a project which will call API(http post) from my app. The post data includes the user's profile. If the user is valid, he will get a discount coupon. But now, I found if some user calls api from PC (ie. chrome), he will get the coupon too. We only accept user apply coupon form our app for pushing our app usage.

I know I can set a secret key when my app send a http post. But I think if someone uses sniffer software will find the key and use it.

So, my question is how to identify this API request is sent from my app. If not, I will reject this call.

Answer 1

You should use https/ssh tunnel and authentication/authorization tokens.

So the your keys and tokens are the secrets and https tunnel prevents sniffing

Answer 2

You can try parsing the User-Agent header to help identify the browser being used, version, OS. But you can't be 100% certain.

For examples of User Agent strings, see https://deviceatlas.com/blog/list-of-user-agent-strings