How do you protect a non-public web API from a malicious app where a developer has discovered how to perform some requests?
Take Instagram's app as an example: Instagram does not have a public API request to POST media. Their policy has been to only allow users to post via the official Instagram app.
However, there are services that allow seems to have been able to POST media from outside the app. I would assume an ambitious developer managed to decompile the iOS or Android app and discover the requests that enabled POST-ing media. Thus, this developer has the ability to spam Instagram with automated posts.
I would also assume Instagram would have attempted in some way to protect their API via either an API key stored in the app or by some other means.
My question is: How do you protect an app against this kind of attack, and if you cannot absolutely protect against this, what are the next best options?