How to make a private API?

Question

API

I'm making a private API for a site, but I can't figure out how to properly implement its privacy. That is, how to make this API just for the application.
That is, how to make it so that only the application has access to this API. There is an idea - to use a password for the apishka, that is, send a POST request like site.com/api/password=123456
And on the server organize it like this

const PASSWORD = '123456';
$password = Yii::$app->get('password');
if ($password != PASSWORD) header('HTTP/1.0 403 Forbidden');

But I think that such a request is easy to track down with a sniffer or decompile the application. So, how do private APIs of this type usually do?

Answer 1

HTTPS or session setup using an asymmetric key, further encryption using the session key.
But if the application itself is opened, then nothing will help.