title: Can android sign a http/https call, to identify uniquely the app doing the request?
body: <p>Say, CORS for apps. Well, not the same thing, but...</p>
  
  <p>Supposse I have uploaded an app to play store, and now I want my server to accept only connections from this app.</p>
  
  <p>How can I do it?</p>
  
  <p>What I would expect of the OS is is some process such as adding to my http request a couple of headers specifying the id of the app in the market, and signing the whole request with a signature in the android chain -or in the corresponding market CA certificate chain-. Then my server could verify that the request comes from the right app.</p>
  
  <p>Plus, the OS could add some certified hardware info so if the app is run in an emulator I could deny service too.</p>
  
  <p>Another way could be to include a "secret" in the app, of course, but it could always be reverse-engineered by decompilation, couldn't it? Or is there some keystore associated to the play store that could be used to provide this secret during https requests to the server?</p>
  
  <p>A third way could be to use the azp field of an OAuth login, but again it could be compromised by decompilation, and moreover it forces the user to log in.</p>