I am a newbie to webservices.
I need help in:

One of the client has a login page that takes the following info:
Username
Password
ProjectID

While username and password are defined by the client, the projectID is
a String that comes from our firm and is necessary for our invoices.

I.e, users from our firm access the client website and enter a projectId.
(this is necessary for our invoices)

We do not want to give them the list of our projectIds to be displayed in
a drop down box on the login page as it is not Wise.

My question:
Can I use Webservices so that : The client can invoke the webservice we provide,
to retrieve the project ID that the user chooses.

The scenario I am thinking of is:
User enters Login and pass.
When he gets to the PROject Id field, He can click a button beside the field
that will invoke a webservice on our server that will display a dropdown
box of our Project Ids.
He chooses a Project ID which is sent to back tot he client.
He can then click Submit on the client Login page.

Is this scenario possible using Webservices?

What are the security implications in this?

PLease Help