Doesn't your API have a problem if it can be misused that way? In other words, shouldn't your backend by default distrust the client using its API, no matter wh

Doesn't your API have a problem if it can be misused that way? In other words, shouldn't your backend by default distrust the client using its API, no matter whether it's the official one or anything else? Even the official client can have bugs that bring down your backend. That's what the "zero trust" philosophy is about.