How do I authorise requests to my GAE REST server?

Question

What's the best technology for to authorise request made by my app/website to my server?

I want only my website and app to be able to communicate with my GAE server.

Answer 1

Are you familiar with the GAE Endpoints service? IMO, the two big advantages of it are that it simplifies:

• the provision of web services to multiple clients type, including Android, web, and iOS,
• the use of OATH2 for client authorization (either Google User authorization, or just app authorization).

I mention it because both of these seem to apply to your situation.

Note though that endpoints is still in preview, and they really mean it. It was released more then a year ago and it has been a bumpy road.