I'm working on a public API for project X. System allows to register an app_id and call API methods providing it, as usual. Now, I need to develop an official mobile client for project X that should have a wider possibilities than unofficial ones built over this API.
In other words, let's think for example we have an API consisting of 5 GET methods. Now I'm going to implement 1 new PUT method and want to allow only 1 exact app_id to use it.
The security problem is that:
If I simply code the check for app_id, it will be easy to overcome, just sniffing the traffic or decompling the app to find this official app_id and then pretend it
Application is a mobile one, thus I can't limit access by IP
Public-key cryptography, where the public key is in the client and the private keys kept in secret by the server seems equal to the problem 1. for me, isn't it?
I do believe it is not a supernova problem, so kindly suggest any reliable solutions, please.