title: How can I uniquely identify a desktop application making a request to my API?
body: <p>I'm fleshing out an idea for a web service that will only allow requests from desktop applications (and desktop applications only) that have been registered with it. I can't really use a "secret key" for authentication because it would be really easy to discover and the applications that use the API would be deployed to many different machines that aren't controlled by the account holder.</p>
  
  <p>How can I uniquely identify an application in a cross-platform way that doesn't make it incredibly easy for anyone to impersonate it?</p>