This question already has an answer here:
We are developing an Android/iOS app. This app tracks the user's GPS coordinates and send them to the server along with other data. The integrity of the sent data is too critical for our service. We would like to confirm that the data is actually coming from our app and not from the user as he/she can send fake data. Encryption alone can be defeated by reverse engineering to extract the required keys. Is there a way to authenticate the application itself?