What you’re describing will prevent requests from roving scans of the internet, but anybody who specifically wants to hit your API will not be stopped. Extracti

What you’re describing will prevent requests from roving scans of the internet, but anybody who specifically wants to hit your API will not be stopped. Extracting certs and credentials from an application package is straightforward and something even a novice could do based on googling. Without accounts, you’re basically stuck. If the devices don’t have any way to prove identity, you can’t identify good requests from bad ones.