title: securing a REST API accessible from Android
body: <p>We're building a game for Android, which needs access to web services - so we wrote a RESTful API in PHP that runs on our own server. What the API offers is: <em>creating user, logging in, downloading games, retrieving game list, submitting score...</em> etc. Now I'm thinking, if some experienced user gets the <strong>URL format</strong> of the API - s/he will be able to trash the system in many ways:</p>
  
  <ul>
  <li>Create a script &amp; run it to create automatic users  - I think I can prevent it by CAPTCHA or someting like that. But again, captcha will annoy game players.</li>
  <li>Malicious user logs in using his browser, downloads game &amp; then submits score as he wish - all via calling the API by simply typing it from his browser. I assume malicious user somehow knows API urls to call - by sniffing when the application was making HTTP requests.</li>
  <li>I need to ensure that requests are made only from Android device that installed the game. (The game will be free)</li>
  </ul>
  
  <p>Now How do I prevent such abuses?</p>