A method of authenticating a service request, the method comprising, by a first server : receiving a handshake request from a client application on a client electronic device via a communication network , wherein the handshake request comprises an application identifier for the client application and a device identifier for the client electronic device, and the handshake request also identifies the client application as having been authenticated to a second server and as being entitled to receive a notification from the second server using a secure and authenticated communication channel ; generating a first nonce, and transmitting the first nonce to the client electronic device ; storing, in a memory, a result of a logical or mathematical operation performed on the first nonce and on a second nonce; transmitting the application identifier and the device identifier to the second server with a request to forward the notification including the second nonce to the client application via the secure and authenticated communication channel; receiving , from the client application, a message that includes a candidate result; determining whether the candidate result matches the stored result: in response to determining that the candidate result matches the stored result, transmitting a token to the client electronic device ; receiving a service request from the client application, wherein the service request includes the token; inspecting the service request to determine whether the service request includes the token and that the token is valid; and upon determining that the service request includes the token and that the token is valid, providing the client application with a service that is responsive to the service request receiving a handshake request from a client application on a client electronic device via a communication network , wherein the handshake request comprises an application identifier for the client application and a device identifier for the client electronic device, and the handshake request also identifies the client application as having been authenticated to a second server and as being entitled to receive a notification from the second server using a secure and authenticated communication channel ; generating a first nonce, and transmitting the first nonce to the client electronic device ; storing, in a memory, a result of a logical or mathematical operation performed on the first nonce and on a second nonce; transmitting the application identifier and the device identifier to the second server with a request to forward the notification including the second nonce to the client application via the secure and authenticated communication channel; receiving , from the client application, a message that includes a candidate result; determining whether the candidate result matches the stored result: in response to determining that the candidate result matches the stored result, transmitting a token to the client electronic device ; receiving a service request from the client application, wherein the service request includes the token; inspecting the service request to determine whether the service request includes the token and that the token is valid; and upon determining that the service request includes the token and that the token is valid, providing the client application with a service that is responsive to the service request <EOS>