How to protect REST API from invalid requests?

Question

RESTful API

I have:

• Rest API on Lumen
  
• HTTP S connection
  
• Basic Authorization: Sent in the login+password header, the response is JWT with acsess_token (for each request with a short lifetime) and refresh_token (to get a new acsess_token)
  

Required:
Implement a request validation architecture. Those. to know that the request came from "its" client (by client, I mean a mobile application). So that schoolchildren could not send requests with pens in the browser) It turns out that a request from a client must be identified according to two points:

1. The request came from a valid client
   
2. The request came from a valid user
   

It was possible...:
The idea was to make two headers in the header, and pass two tokens into them: one issued to the client, the second issued to the user. But two cannot be, and in url to transfer - a crutch.
UPD: Two headers are possible, parsing them is not a problem. But is this a good solution?

Bottom line:
How to do client validation without crutches?

Answer 1

Everything that is done on the client side can be parsed and secret information can be pulled out. Therefore, any application running on the client side is, by definition, insecure and there is no point in authorizing it. This can be faked.
What you want can only be done with server-side clients.
I think you should rethink your task again. Perhaps it is worth describing the situation in more detail, why you are trying to combine an incompatible, on the one hand, a closed API and, on the other hand, a public mobile application.
It doesn't work like that. There are two options to choose from:
1. Public API -> Public Client (runs on the client).
2. Closed API -> Closed client (runs on the server).

Answer 2

It is possible to use the phone's IMEI to check if it is a phone. Here is the IMEI base and API for it www.imei.info/api/imei/docs However, there are programs for replacing IMEI, as well as for generating it.