You could keep a private key in a secure enclave and use it to sign each request or even just signing a password with a nonce. Though if your attacker has root

You could keep a private key in a secure enclave and use it to sign each request or even just signing a password with a nonce. Though if your attacker has root they can change what is on the screen anyway.