Here are some ideas.
- Everything has to be SSL TLS v1.2+
- Having a login/password would be best
- Having succeed in logging the user gets a code random 64 bytes or more
- The request is modified so instead of https://www.etc.com/file you have https://www.etc.com/random 64 bytes or more/file
- The code expires either when the user logs out or time based
- Time base is more secure, and the app can fetch a new code every say 5 minutes
- Each code is internal tied to an IP address, and the user has to re-login if it changes.
- Any IP submitting false 64 bit token is banned. say 20 minutes.
If they MITM the SSL cert and packet dumped the traffic it might still be possible, but the bar is raised significantly. Certificate signing and pinning make this incredible difficult.
This way no fixed code is stored in the app. The user has to pass through a user/password check to even get said code. Even if you publish the source code a valid user name and password will still not be present.
Each user and if multiple logins per user are allowed each instance has a different key. If they have a cell phone and a tablet.
Without a username/password any process can be reverse engineered. The 64 bit token can't be easily guessed, but the process of getting one could eventually be guessed.
PHP has a "session id", and you could symlink the session id to the real folder internally. Deleting said folder after 5 minutes or etc. Probably better to use a secure random function.