I have an API and a web application where users can login through another system and then post text messages to my application, for example.
How can I assure that when this data is only posted to my application, and not sent to other websites?
If I read the question correctly, long story short is that you can't.
Data is being input into a system under someone else's control. Any measure you take to ensure the data is sent to you can be circumvented by the other party.
Can you give some more information about what you are trying to prevent? The situation still doesn't seem very clear. It sounds like you have some backend API and a front end application that uses the API. In addition, you want to be able to do a login from some other system.
If you want to make sure data from your application can only be sent to your API, then you need to either have the application expose a callback for the login and then have the application relay this information to your API or, alternately, you could provide an authentication API that the login could use. In this case, your Application would need to produce an authentication challenge associated with its current activity, that challenge would then be sent to the login service to be verified. When the login service provides authentication back to the API, it would be able to call back to your Application and allow the transaction to occur between your application and your API.
I'm not sure if this helps since the question is hard to understand. I can update my answer if you can provide more details.