I have a desktop application which creates and stores a fair amount of data (mostly on its own, not through traditional user input); mostly statistical in nature.
Currently the data is mostly accessible only to other applications that I've written myself, and isn't exposed to the user other than through these applications.
I'm considering allowing third-party access to this data via a REST API or similar, but in this case the "server" would actually be running on the same machine as the client (or another machine in the same LAN, at most).
However since this access is intended to be monetised I want to have some kind of authentication to allow specific clients access to specific subsets of the data, rather than providing blanket permissions.
(So the goal is not user authentication, but client app authentication; in the human sense all the data is for one user, but should only be accessible through authorised apps.)
Obviously since everything is running client-side I've basically already lost (a sufficiently determined user wouldn't have any trouble extracting and spoofing credentials, and AFAIK it is literally impossible to prevent this) -- but what would be the best practices for providing a reasonable level of security against insufficiently determined users?
Most of the usual recommendations for REST API authentication (SSL, OAuth, etc) don't really seem applicable since they assume a separate and secure server. (And SSL is mostly concerned with validating the server.)