A method for authentication of a first client in communication with a second client via an authentication server is disclosed, such that the first client and the second client are authenticated to each other, and the authentication server is authenticated to both the first client and the second client. The ability of a client and an authentication server to generate a one-time-use key unique to the client for a given request, is used as the basis for authentication. The flow of requests and responses coupled with each client's unique one-time-use key, such as a one time use account number used to encrypt messages, results in all three entities, the two clients and the authentication server, mutually authenticating each other. The method effectively prohibits a "man-in-the-middle" attack, wherein an unauthorized entity tries to assume the roll of one of the two clients, or the authentication server.