How to authenticate API calls to make sure they are from specific remote contracts

[alcyoneus-g]

I have 1 master reach contract and multiple remote contracts that run independently and report back to main contact by calling API afterwards. currently, it works but there isn't any security enforced on the contracts itself (main contract doesn't restrict the api calls only to the remote contracts).
What techniques, best-practices or idiomatic solutions are there to solve this issue? (currently I've an idea of minting new tokens and giving them to the remote contracts in the beginning and making them pay that when they report back but I don't know if this a good idea of not). thanks

[jeapostrophe]

The token idea is clever. You could have the child pay and then get paid back.

It is easy to have 1 thing authenticate TO many, because they can know its address and check it with this.

It is hard to have many authenticate TO one, because someone trusted needs to tell the one about the many individually and have the one record it. The one could record with a Map.

[alcyoneus-g]

thanks for the feedback. I think this is no longer available for use in parallelreduce syntax anymore on version 0.1.11 and onwards? https://docs.reach.sh/changelog/#p_30
what other construct can be used for such purposes or I misunderstood?

[jeapostrophe]

It is available. It is only not available in the define and while and invariant blocks.

[alcyoneus-g]

oh okay, thanks