It's a valid desire, but you have to be really dedicated to the effort to block it, in practice. You might intend your API to be consumed only by your own clie

It's a valid desire, but you have to be really dedicated to the effort to block it, in practice. You might intend your API to be consumed only by your own clients. E.g. your published mobile apps. A well-designed API won't allow a third-party client to do anything that your own client wouldn't allow of course. Permissions are always enforced on the back end. But there are many cases where a user might want a custom/different client: If your mobile apps are not awesome, or if they deprioritize a specific use case, or if they serve ads ... or even if your users want to automate some action in your service... If your service is popular enough (or you attract a certain kind of user), you will have some people building their own clients.