I have this webservice at work. For that webservice our department have developed a client to consume the webservice.

What we want to prevent is, that they develop any other client to consume it. 

Is there any algorithm, practice that we can improve in our client and webservice communication to validate that the consuming client is our application?

I have an idea, that we can develop an encrypting algorithm about the time (5 seconds of grace) that must match with the calculated on server.

But i want to be sure, there is no best practice for that... or if it still a good idea...

(sorry about my english)