You can create a sneaky change to the protocol, or something that looks unnecessary, but still works without it temporarily. (or check the order in which the he

You can create a sneaky change to the protocol, or something that looks unnecessary, but still works without it temporarily. (or check the order in which the headers are formed, or something.) Then you can detect which clients don't conform exactly to the internal specs. And then you can send those accounts an email telling them they'll be banned if they continue to use external clients. This strategy only works if you have a single blessed version of a client, and it's really only because of security by obscurity. For the mentioned business model, it would not work unless you created a single authoritative server that acted as a proxy to the other API or consumed data from that API without giving the app a key. Snapchat may or may not have used this strategy. (The external client emails were real; as for the detection strategy, who knows.)