How do I make a service only runable by the server?
Along with Brad's answer, one additional easy check in your code would be to see if the $_SERVER['REMOTE_ADDR'] is the server's IP and then bail if it's not.

That means you'd have to spoof the server's IP address AND guess the key. No better than a username/password combination but should be secure enough IMO.