I have a C# REST API which exposes some methods over the HTTP protocol. The API is intended to be used my my Android applocation (Java) which is currently in the makings.

Since the app is in an early development stage, and hasn't been released yet, I access the API methods using http://example.com/resources/item17 without any additional security. However, as soon as the app is released, I don't want anyone but my app users to access the API. 

My idea is to generate some kind of unique key in my C# + Android code. A simplified version to give you the idea:

int key = DateTime.Now.Minute * Math.PI * 5;


This would make the request look something like:

`http://example.com/resources/item17?key=1234567`


The C# API would verify this before sending a response. 

The only way to figure out how the key is generated would be to reverse my Android code (which will be obfuscated at that point).

Does this sound like a good solution, or do you have any other suggestions?


Question: Is it possible to encrypt a file so that it can not be brute forced?
Answer: Check out http://www.theregister.co.uk/2014/01/21/shapeshifter/ and the wiki entries for Oligomorphic Code and Polymorphic Code.  I think ultimately, encoding is a means of representing infinite possibilities in a finite set... at the end of the day, there are collisions of the infinite set in the finite representation, ergo "decoding" via brute-force could lead to collisions that aren't actually the decoded file.  

warning: I haven't slept in a couple of days.