A method of authenticating a service request, the method comprising, by a first server (102, 302): receiving (202, 402) a handshake request from a client application on a client electronic device (101, 301) via a communication network, wherein the handshake request comprises an application identifier for the client application and a device identifier for the client electronic device, and the handshake request also identifies the client application as having been authenticated to a second server (103, 303) and as being entitled to receive a notification from the second server using a secure and authenticated communication channel (117, 317); generating a first nonce, and transmitting the first nonce to the client electronic device (101, 301); storing, in a memory, a result of a logical or mathematical operation performed on the first nonce and on a second nonce; transmitting (204, 403) the application identifier and the device identifier to the second server with a request to forward the notification including the second nonce to the client application via the secure and authenticated communication channel; receiving (209, 411), from the client application, a message that includes a candidate result; determining (210, 412) whether the candidate result matches the stored result: in response to determining that the candidate result matches the stored result, transmitting (211, 413) a token to the client electronic device (101, 301); receiving (212, 414) a service request from the client application, wherein the service request includes the token; inspecting (213, 415) the service request to determine whether the service request includes the token and that the token is valid; and upon determining that the service request includes the token and that the token is valid, providing (214, 416) the client application with a service that is responsive to the service request receiving (202, 402) a handshake request from a client application on a client electronic device (101, 301) via a communication network, wherein the handshake request comprises an application identifier for the client application and a device identifier for the client electronic device, and the handshake request also identifies the client application as having been authenticated to a second server (103, 303) and as being entitled to receive a notification from the second server using a secure and authenticated communication channel (117, 317); generating a first nonce, and transmitting the first nonce to the client electronic device (101, 301); storing, in a memory, a result of a logical or mathematical operation performed on the first nonce and on a second nonce; transmitting (204, 403) the application identifier and the device identifier to the second server with a request to forward the notification including the second nonce to the client application via the secure and authenticated communication channel; receiving (209, 411), from the client application, a message that includes a candidate result; determining (210, 412) whether the candidate result matches the stored result: in response to determining that the candidate result matches the stored result, transmitting (211, 413) a token to the client electronic device (101, 301); receiving (212, 414) a service request from the client application, wherein the service request includes the token; inspecting (213, 415) the service request to determine whether the service request includes the token and that the token is valid; and upon determining that the service request includes the token and that the token is valid, providing (214, 416) the client application with a service that is responsive to the service request