How do I make sure my API is only called by my own app, and not by someone with a copy of the requests?

Question 2 is a good one because API keys are widely misunderstood.

A key in a server-to-server context is a real secret: it lives on a machine you control, and nobody else sees it. That is the case they were designed for and there they work.

A key in a client is not a secret and was never treated as one by anyone who thought about it. What it is instead is an identifier: it tells you which application the traffic came from, so you can meter it, revoke it, and see when one integration starts behaving oddly. That is genuinely useful — it just is not authentication.

The failure comes from treating the second one as though it were the first. A public key with a rate limit attached is fine. A public key that grants privileged access is a credential you have published.

The goal is wrong, and it is worth being blunt about it because a lot of effort gets spent here.

Anything shipped to a client — an app binary, JavaScript, a mobile package — is in the hands of the person running it. They can read it, decompile it, or simply watch the network traffic their own device produces. There is no secret you can put in that package that stays secret, and no header you can send that cannot be replayed. Obfuscation raises the time cost from minutes to hours and changes nothing structural.

So "only my app can call this" is not achievable. What you can achieve is "only an authenticated user can do things on their own behalf, at a rate I allow", and that is almost always what people actually needed.

The reframe matters because the impossible version leads to weeks of work on attestation schemes that a determined person bypasses, while the achievable version is standard and effective.

For question 3, the things that actually work, roughly in order of value per hour spent:

Authenticate the user, authorise every request. Each request should be checked against what that user is allowed to do, server-side, every time. This is the one that matters. Most real incidents are not "someone used our API" but "someone changed an id in a request and got another customer's data".

Rate limit per user and per address, with something stricter for unauthenticated endpoints.

Keep the expensive and dangerous operations behind your own server. If the client never has the ability to do the costly thing directly, no amount of replaying its traffic gets there.

Monitor for shape, not identity. Abuse looks different from use — bursts, sequential ids, odd hours, one account from many places. That is what catches the real cases.

Platform attestation services exist and do raise the cost for casual copying. They are worth considering after the above, never instead of it.