I am not an expert in security, but here is a hopefully better explanation of my concerns.
By trusted source I simply mean, we are hosting our API at www.myapi.com/some/stuff. So if the client calls the endpoint at that URL we are going to assume that it is a trusted api. Maybe that's bad to do? I don't know I am not a security expert.
Also, we are going to be serving everything over SSL.