Web service with application-level and user-level authentiation
Under D6, using Services 3.x

It may be more easy to consider that:


User authentication should be handled directly by Services (OAuth/API/Session)
Using an specific mobile app is a Permission:

in your module, in the resources definition, add a access_callback &amp; access arguments:



Code:

/**
* Implementation of hook_services_resources().
*/
function mymodule_api_services_resources() {
  return array(
   'myresource' =&gt; array(
     'retrieve' =&gt; array(
       'callback' =&gt; '_mymodule_resource_retrieve',
       'access callback' =&gt; '_mymodule_api_access',
       'access arguments' =&gt; array('Use registered mobile app'),
       'access arguments append' =&gt; TRUE,
       ...



add corresponding permissions in a my_module_permission() hook:
Code:

/**
* Access callback for the resource.
*
* @param string $op
*  The operation that's going to be performed.
* @param array $args
*  The arguments that will be passed to the callback.
* @return bool
*  Whether access is given or not.
*/
function _mymodule_api_access($op, $args) { ... }

And then return false if the mobile app is not registered...