No, CSFR tokens, validating API keys, restricting the origin of request, etc is how to restrict access to the API. TOS is only text to keep the honest honest,

No, CSFR tokens, validating API keys, restricting the origin of request, etc is how to restrict access to the API. TOS is only text to keep the honest honest, the security layer is to keep the attackers and others without access out. A TOS is the web-site telling how it want you to behave, and all it can do if you don't behave that way is to do its best to not let you in. Nothing of this stops you from trying to reverse engineer the protocol. The best part with using an API is that, at least in theory, it is stable and will not have changes that breaks your integration with it