title: How to authorize API calls made from a mobile app without any registration and login?
body: <p>My mobile app does some API calls during usage and some of them should not be possible from anywhere else (e.g. postman)</p>
  <p>For instance if you have a database table <code>user</code> and a column <code>membership</code> and the app-user does an in-app-purchase an API call is made to update that row and change the column from e.g. <code>standard</code> to <code>premium</code></p>
  <p>Now in theory if someone knows the URL and sends an HTTPS request he could upgrade himself without purchasing anything. I am researching for a while now but feel a bit lost. There is no registration or login. I use the unique hardware ID of the users devices as a primary key to store everything in the database. I thought about something like:</p>
  <ol>
  <li><p>When the user opens the app a request is send and the server responds with a randomly generated key</p>
  </li>
  <li><p>All requests the user makes have to use that key which I would send in the header otherwise it gets rejected</p>
  </li>
  </ol>
  <p>Is this the only thing I can do? What is the best practice for a mobile app that does not use any kind of registration?</p>
  <p>If it matters I used flutter for the app and flask for the backend that is connected with a postgres database</p>
  <p>edit: I am using HTTPS everywhere not HTTP</p>