Limit REST API access by clients

Question

We develop a mobile application, so we have a REST API(server-client).

Is there a way to limit that only our mobile application can send requests to server through API? So, best will be that server will not accept requests from other clients, maybe it is possible to do that with certificates?

Answer 1

You can check in your web services user agent. If use agents is mobile device and you can generate token for each device and you can identify the requested client..

Answer 2

If you use SSL you can work with client certificates.

Another option is to use a Client ID and a Client Secret. Use the client secret to sign your client ID within the request.

Use OAuth with the Client Credential grant. This is more or less similar to the above one but more formalised and you can use standard libraries.