title: How to be sure that your PHP script is called only by your authorized app?
body: <p>Let's say I have a PHP script on the server called process.php. I want to call the script from an iOS/Android app. I want to make it impossible to call the script without the app, for example to call it from a computer. How could I make this verification process secure and unhackable?</p>
  
  <p>Some things I have thinked at:</p>
  
  <ol>
  <li><p>Using a static key that would act like a password to unlock the script. This is not a very good method because once your key is hacked (maybe reverse engineering, the key being stores in your app) they got total access to your script.</p></li>
  <li><p>Creating a hash function and follow the following steps:</p>
  
  <ul>
  <li>make a request to the server and get a string</li>
  <li>hash the string on the local device</li>
  <li>send the hashed string back</li>
  <li>if the string received by the server is the same as the string which the server expects (the request send which was hashed on server) I unlock the script
  This way you can get access only if you have the hash function. Is this secure enough?</li>
  </ul></li>
  </ol>
  
  <p>What other alternatives I have without user's login credentials?</p>