I have a C# REST API which exposes some methods over the HTTP protocol. The API is intended to be used my my Android applocation (Java) which is currently in the makings.
Since the app is in an early development stage, and hasn't been released yet, I access the API methods using http://example.com/resources/item17
without any additional security. However, as soon as the app is released, I don't want anyone but my app users to access the API.
My idea is to generate some kind of unique key in my C# + Android code. A simplified version to give you the idea:
int key = DateTime.Now.Minute * Math.PI * 5;
This would make the request look something like:
`http://example.com/resources/item17?key=1234567`
The C# API would verify this before sending a response.
The only way to figure out how the key is generated would be to reverse my Android code (which will be obfuscated at that point).
Does this sound like a good solution, or do you have any other suggestions?