Your solution relies on the assumption that reverse-engineering of an obfuscated app is hard. However, this assumption does not match experience. Therefore, one cannot really tell that your solution is good.

However, maybe your solution is the best that can be done (not the same thing as "good"). The alternative is user authentication. Namely, each app instance would get its own authentication key; then, it is up to the server to accept a key or reject it. This gives you the ability to revoke a key which appears to have been reverse-engineered; it may also give you legal leverage to prosecute offenders.

If you do pursue the concept of generating a time-based key in the app, then at least do it with the proper cryptographic tools. In this case, use HMAC: encode the current time into some bytes, then compute HMAC/SHA-1 (or HMAC/SHA-256, whichever is easiest for you) on these bytes, using a hardcoded key. The hardcoded key is the target for reverse-engineering. Using HMAC will at least protect you from key reconstruction by analysis of the output: the attacker will really have to do some actual code disassembly. You will also need the app to send its notion of "current time" as an extra parameter, because you cannot rely on the client device being well synchronized.

(None of this being exclusive with running the whole thing in HTTPS, which is usually a good idea when security matters, but is really another subject here.)

Key-agreement protocol in a REST API
I know that a PC can have multiple network adapters each of which with different network identifiers (IP,MAC etc.). 

My question is, can a certain PC have more than one active default gateway? And if so, how does the PC (or better say the OS) knows to what adapter use for any given packet?
