title: Authenticate list of growing devices forever
body: <p>Excuses for the bad title but I couldn't think of something good and concise..</p>
  
  <p>Anyway I have a webservice which provides some standard crud operations on some data. This webservice is mainly consumed by other software. The other software runs on some smallish linux devices. These devices will continue to increase as the lifetime of the product increases. </p>
  
  <p>Since I want the entire product to be plug and play and I want to be able to send my customers new devices which will be able to authenticate automatically and who don't have to be configured in any way by my customers at all. </p>
  
  <p>I could achieve something like that with just a static api key but really If there is a leak even once the entire system is compromised...</p>
  
  <p>The next idea I had would be to automatically generate a new api-key every week and send it the existing clients and I would just have to put this api-key into the hardware I would send my customers. But this has 2 issues. Some devices might not be available for more than 1 week so it could miss an api-key update. 
  New devices might not be connected for 1 week. </p>
  
  <p>I am thinking that maybe I could generate api keys based on some specific datetime each week so I have an algorithm on the client and server that generate the key and use that. But I fear that this might be reverse engineered in some way.</p>
  
  <p>I am close to a total beginner in security so any help would be appreciated!</p>
  
  <p>My server software stack is c# and most of my clients will be python but other languages are possible.</p>