With the recent advances in technology, smart cities are rapidly earning momentum. To provide better lives, smart cities should host several applications to increase the efficiency and accessibility of services. Since these services involve the conveyance of significant data among the smart cities’ cloud and the dwellers over the Internet, security and privacy are critical. This paper proposes an authentication protocol with a full aggregation signature to secure the smart city applications. A certificate-less aggregate signature (CLAS) is used for smart city real applications such as secure routing and database outsourcing. The proposed CLAS achieves message authentication, user anonymity, constant signature size, unlinkability, and is resistant to replay attacks. Also, we have proved that the proposed scheme is resistant to all malicious adversaries. Finally, the performance evaluation results show that the proposed CLAS performs better than existing relevant schemes.