The question title is... ugly to say the least. Here's an overview of what I've got:
- I work on an online tool. Data is sent to it, it processes the data (an intensive task) and sends results back.
- The tool is sold to organisations who want to include the functionality in their public websites and apps for their customers to use. The tool remains on our servers (no client has access to the code or binaries)
- I need to stop unauthorised organisations using the tool in their sites and apps.
Inside a browser, authorisation is easy; I simply check the ORIGIN header when requests are made and all is good (individual users hacking their headers isn't important).
In apps it's a different story. First, I need to prevent applications simply using the browser interface (or rather, make the browser interface the same as the app interface), then I need to use keys or similar to authorise allowed clients.
I realise that no matter what authorisation I put into the apps, it can always be hacked out because they're public, but this can't be a unique situation, so I'm wondering what solutions have already been developed. (Since I have limited knowledge of security terminology it's proven hard to search for!)