I'm afraid I still don't quite understand how a username and password is required. If it is free to sign up for a username and password, then people could just

I'm afraid I still don't quite understand how a username and password is required. If it is free to sign up for a username and password, then people could just sign up with your service and then hit your API directly. All you've added is an inconvenient barrier for your users that wouldn't stop an attacker. After all, if the attacker can be bothered figuring out how your application talks to your server, he or she can probably be bothered signing up for a username and password. On the other hand, if your application costs money, then why not require a valid license key to access your server. True, you'll get the problem of people pirating software and reusing the license key, but it shouldn't be too hard to monitor your server logs and ban any license key that is submitted by a large number of unique IP addresses in a short period.