BLE device authorization

[diode]

I want to make a BLE peripheral device that only allows connections from authorized mobile apps, and an app that only allows connections from authorized BLE devices. What will be the best design approach? Is there any example?

[Hung Bui]

If bonding is allowed, then you can set up white listing and permission of the characteristic to allow only bonded device to access. If no bonding is allowed, then you should follow what shibshab suggested.