I'm developing a game which has an accounting system very similar to the one used in Geometry Dash, where the user can also upload levels or vote on them, without the need to be registered with an username.
I was thinking: in theory, someone could easily create a fake program which emulates my game's mechanism to send data to my own server to create tons of fake users to self-like their own levels.
Even worse, he could send gigantic data masked as level files to cause newtork congestion.
Since, according to what I found, there is no safe way to identify the POST source, the solution could be, in theory, have some sort of password stored in the game data which of course only the real game would have and send it with all the POST data (with asymmetric encryption of course) as an authentication key. But of course any skilled hacker could find it by disassembling the game if it's hard-coded or stored somewhere as XML or similar.
So the question is: in iOS and Android at least, is there any kind of super-safe place to store a password from the very begin inside the game data? I was looking at keychains but it seems like they are made to store passwords and stuff after you install the game and I readed there are some exploits if the phone is rooted/jailbreaked, so it doesn't seem what I'm looking for.