I have the following situation:
On the server B there’s a PHP script that can create/delete files so I wanna be sure that I’m the only one able to call it from server A through a CURL request.
I’m adopting the following security:

• script on server B check that the Referer is server A (is it safe?)
• before calling the script on server B, server A stores a key on a DB, then this key is sent with the request to the script on server B. The script on server B calls another script on server A to check that the received code is the same on the DB. Only if the code is the same, the action is executed by the script.

Is that secure enoguh?