Authorization/Licensing of Webservice

Question

I have developed a web service which accepts the login credentials from the XML message passed to it. I have concerns over this method as the developer who consumes the service can easily share the login credentials and my service can be called from some other application that uses the same credentials.
Is there any way that I can issue a 'license' to some specific applications? So that, even if credentials are shared among the consuming apps, only authorized ones can successfully consume the service.

P.S: I thought about implementing IP restrictions but that doesn't serve the purpose as we may have different applications installed on a same server (we do have such a scenario implemented).

Answer 1

Did you look into having security certificates installed on the client machines. Verisign and other companies like it issue certificates that your client will need to install on there calling machine.

This of course comes for a fee!