I have a server which is composed of a page and a web service. The web service is intended to be used by a Windows Phone mobile application that I will develop myself.

Now, my question is, how do I identify that the web service request is coming from the mobile application I developed? On normal web applications, one can make use of a combination of certificates and digital signatures to ensure the identity of the caller.

The main problem is that Silverlight does not allow the developer to load the certificates installed on the mobile phone and get the private key to sign the data. I thought of hardcoding the private key into the application, however this is not secure at all as the application can be easily disassembled and reverse-engineered.

What else can I do to make sure that the web service request came from the mobile application I developed rather than from a normal web application?

  • How much effort to put into this depends on what you are trying to accomplish. What is your goal?
    – GdD
    Apr 29, 2013 at 16:08
  • @GdD The web service will be used to make payments online using credit card details. Even though I authenticate the user everytime a call is made, I would like to verify that the call was made from the mobile phone app itself and not from a normal computer app.
    – Joe Borg
    Apr 29, 2013 at 16:17

1 Answer 1


You can add an API_key to your authentication process - something that a user needs to request first thing from the server. This initial request can contain device specific information, application specific information and user identity bits. Generated API_key can be a cryptographic hash function of that data.

A server stores all the API_keys and link a key to a user (if you want).

Only requests that have valid certificate and API_key are authenticated. You can then only allow one simultaneous log on with a valid API_key to mitigate API_key sharing.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .