What you are looking for is a authentication or authorization method for your WebService, but this varies depending on the technology you have developed in developing your WebService. If you are using WebServices SOAP or WCF with .NET is one approach, if you are using REST APIs the approach is another. Do you understand how this can be complex?
I'm going to give you some information that can give you an insight into what can be done, based on .NET technologies that dominate. Also, you did not explain what technology you used to develop your backend.
Basically authentication with Web services involves sending some information in the header of the request and processing this data on the server, validating the user (device) or not, which should generate an error #.
There are libraries and frameworks that help you do this on every technology, for example in ASP.NET MVC has ASP.NET Identity OAuth 2.0 that can be used with Web API and also integrates your application with social networks like Twitter and Facebook.
Within each approach, there are also many ways to implement authentication.
Now, if you want to develop everything at hand, which is not ideal, you can include a parameter in the WebService methods that can serve as a validation token, and in each you can create a method to validate this token.
I'm not proud of this, but I've done it a few times, below the example of a method I created in a WCF:
public class WcfClientValidations : IWcfClientValidations
{
DataContext context = new DataContext();
public string GetData(string clientToken, int code)
{
TokenValidation(clientToken);
return context.Data.Where(o => o.code = code).ToList();
}
private void TokenValidation(string clientToken)
{
if (string.IsNullOrEmpty(clientToken))
{
throw new Exception("Token inexistente !");
}
try
{
var clientCode = (int) Base64Decode(clientToken);
var clientDb = context.Clients.Where(o => o.code = clientCode);
if (clientDb == null)
throw new Exception("Cliente inexistente ou token inválido !");
}
catch (Exception e)
{
throw new Exception("Problemas ao validar o cliente !");
}
}
private static string Base64Decode(string base64EncodedData)
{
var base64EncodedBytes = System.Convert.FromBase64String(base64EncodedData);
return System.Text.Encoding.UTF8.GetString(base64EncodedBytes);
}
}
As you can see in the GetData method I get a clientToken that is converted and validated by returning an exception if the client does not exist.
I hope I have helped, although I did not have much information in the question.
