title: Authenticating against a REST API with iOS client using Facebook SSO as the only login mechanism
body: <p>I'm planning to use Facebook as the only sign-on mechanism for an application that I'm building and need some feedback on the design. Here it goes -</p>
  
  <p>User opens the app and is presented with a register screen. The facebook authorization flow starts and let's assume it succeeded and the user has successfully registered himself. Upon success, the app calls the Facebook graph API and gets the user's firstname, lastname, email, date of birth etc. With this data, the app then calls a web service method called <code>RegisterUser(string Fullname, string FirstName, string LastName ...)</code> which creates the user record in the database.</p>
  
  <p>Now for subsequent calls to the API, I need to authenticate that the request is really coming in from my application (not necessarily a particular user). I've looked up the S3 REST API and it seems that with every request there's a HTTP header called <code>Authorization</code> that the client creates by appending a bunch of other HTTP Headers like Date, Method, Request data, signing it with the client's private key and computing its base64 encoded value. This is verified on the server side to authenticate the client.</p>
  
  <p>Now, I'm comfortable implementing all this, but a few questions: <br></p>
  
  <ul>
  <li>If I have a private key, is it safe to include it as a part of the iOS application itself? Can someone extract the key from the iOS application binary? If so, how do I deal with this?</li>
  <li>Are there any other changes you'd make to this design ?</li>
  </ul>
  
  <p>Thanks, <br>
  Teja. </p>