I'd like to have my server APIs only accept requests from my own app, to prevent other "rogue" clients of my service.
As i understand it, the way to do this would be with a "client certificate" that the app sends, and that the web server is configured to verify.
However, I'm hosting my app in Heroku, and I believe it's not possible to do that, so I'm looking for something as good as possible that would allow me to achieve this.
I thought that maybe I could have a key pair, where the client uses a private key to sign a certain agreed-upon token (plus some random salt, so that the encrypted string is always different), and the server uses the public key to verify the token (and rejects duplicate salts to prevent replay). Or maybe the client signs the whole request with its private key, or something like that.
The idea would be that even if someone manages to get around our SSL pinning (with something like iOS kill switch, potentially) and inspect our traffic and figure out how our API works, they still can't call us unless they reverse engineer the binary to extract that certificate / private key. I understand that it's possible to do that, I'm just trying to put up as many barriers as possible.
What are good ways of doing this?