Discourse headless?

I would make my custom app set a custom header when calling the Discourse API, and add a small rule on the internal Discourse nginx to 403 all requests without the special header.