What you have described is really how sessions work, except most commonly use cookies to send the session id instead, but it must be sent per-request as http is stateless. (except the session id is random)
You can try using OpenAuthentication (OAuth). There is a popular bundle called FOSOauthServer.
OAuth has different grant types. grant type password is the closest but expects a username/password sent. Password could be blank and the username could be the serial number, however it's best to create a custom grant type to look up the user via the serial number instead. See here.
You can use the serial number to generate an authentication token for subsequent access. there should be some client side implementation for node you can use to handle all this but it's rather trivial.
this way the authentication token that is returned is sent in the http headers and there is no exchange of the serial number.
Also note that the authentication key does expire but there is a refresh token for that.
Further, you should use https to secure the connection if you're worried about sniffing anyway.
Example Request with custom grant type using FosOauthServer:
http://localhost:8000/oauth/v2/token?client_id=1_2n0hvjywrfeoowswk84ggcs0cwwwccwg80g4s4kw04g0o0kos4&client_secret=60m8u9xkzns4gwos4csw40o0ccwg4cgkksggwgwcgcc0s0ksog&grant_type=http://custom.com/grants/serial&serial=123456
Response:
{
"access_token": "NjY2MzA3NzE5OWI2YjdhNWViYTg0MmI2NmIyNDE5MjAyNWM4OTcxMzg1MjY2ODk3NmZiNDIwODM0Y2VmNmZkMg",
"expires_in": 3600,
"token_type": "bearer",
"scope": null,
"refresh_token": "ZWRjNWNhMjcxYzRhNWNjNzk3ZmQzMzM5ODgzYzI1YzNlZjcwNzhkYjNhNjA2YzNiZTY0MTM5ZDllYWNhYzliMg"
}
Now for the secured URLs you add the token to the http header per request. Or Alternatively use a OAuthClient to do it for you and handle refresh.
Authorization Bearer NjY2MzA3NzE5OWI2YjdhNWViYTg0MmI2NmIyNDE5MjAyNWM4OTcxMzg1MjY2ODk3NmZiNDIwODM0Y2VmNmZkMg
