Question, is there any way to design an API such that it can't just be reversed into a new client library like this? Certificate pinning makes it harder to MITM but that's trivial to disable.
If you create a door, that door is going to be used to enter and to exit.
Except if you add a lock)
even with that you can use key to open the lock and key has to be stored somewhere and end user can always get it right?
theoretically no, but snapchat do a damn fine job of locking accounts that use iphone tweaks. it's not perfect but they seem to create enough FUD that people are wary to use them.