evilswan

Hello HN! Hoping I can tap the colossal power of the HN hive-mind.

Working on a project where an iOS client hits an API. How do I ensure that only my 'real' client is allowed to use it?

I could bake a secret token into the app, but surely it will just be sniffed (HTTPS only, but a MITM proxy?) or the app decompiled and the token extracted (Like the Sony PS3 master key).

Is there any reliable way to ensure that a hacked, dummy version of my app can't use the real API?

Thanks HN!

The system will be a CRUD back end for an iOS app, later offering a web app, then otehr clients, etc. I'm outsourcing it, so the choice of language/appserver will be up to the lucky (!) programmer.

Will be RESTful with JSON data exchange. Linux on EC2.

Other than that - what would you say would be the best route for:

- Low system overhead - Fast performance - Low resource usage - Scalability to multiple appservers (eventually)

Ruby on Rails? Pyton / Django? PHP on a framework?

Or doesn't it matter?