Accept request from my app only

[eluser]Pascal Kriete[/eluser]
IP addresses are easy to spoof, particularly on packet level. The problem is that if you've spoofed the ip address you'll need to be around the server - usually in the same subnet - to catch the response.

I would go with a mix of ideas. Filter the ip (.htaccess filtering is easiest), and also send a unique token.
Most forms in your application should have a token anyways, to prevent csrf exploits.