This question already has an answer here:
- Securing an API for mobile access 6 answers
I am developing a webserver and provide an API to be used by mobile clients.
Some of my calls are without any authorization, for example, to start the authentication process.
Is there a good way/best practice to verify that these calls are made only from the device?
For example, my authentication process used a 3rd party service to send SMS messages, and if someone uses this API from the computer he can cause the sending of many SMS messages which would cost much. Is there a good way to prevent such attacks?