Your API doesn't need to know who's calling. It needs to know if a human is behind the call. The IETF Web Bot Auth working group just published its charter draft.
Source: [Dev.to](https://dev.to/htl-core/what-web-bot-auth-deliberately-leaves-out-4gka)