Can't you do some degree of enforcement--even a reminder--by checking the referer header? Might not want to rely on it by refusing to process if it's not there

Can't you do some degree of enforcement--even a reminder--by checking the referer header? Might not want to rely on it by refusing to process if it's not there, but perhaps making another hoop to jump through to try to make it easier to do it the right way. Like, a different API call for backend transactions that doesn't require a referer. You still have the odd user cloaking it, though.