It seems like a motivated person could determine the key if they wanted to.  

Would it be possible to send a unique key along with each instance of the application when it is downloaded?  A GUID or a UUID might be good for this and it would be much harder to predict.  When someone downloaded the application you would send that key along with the instance and then insert it into a database that you control.

Then when a request is submitted you can confirm that it exists in the database.  This would also allow you to track the number of requests coming from a specific key.

With the original, any way to identify if the code has be compromised.  For example if you have 100 users and are getting 1000 requests a day and then it bumps up to 1100 requests a day that would probably look normal.  If you identify the number of requests from each key you can see that normally you get 10 requests a day from each of your keys, but if it bumps up to 1100 requests and a single user goes from 10 to 110 requests, you can probably say that that key was compromised and disable it.

Key-agreement protocol in a REST API
Given that A $\begin{bmatrix}1\\-2\\1\end{bmatrix}=\begin{bmatrix}2\\-3\\-5\end{bmatrix}$ and A $\begin{bmatrix}1\\4\\-2\end{bmatrix}=\begin{bmatrix}0\\2\\-1\end{bmatrix}$ find A $\begin{bmatrix}1 &amp;&amp; 1\\-2 &amp;&amp; 4\\1 &amp;&amp; -2\end{bmatrix}$

Not really sure how to approach this question. Help would be much appreciated :)
