How can Twitter and other platforms prevent third party clients from using their API?

Question

A while ago Twitter made changes to their API that prevents the use of third party clients. Reddit apparent did something simmilar. How is that possible on a technical level?

The way I understand it, if you open the official twitter app or visit the official twitter website it makes a API call to retrieve the content it then displays. Couldn't third party applications just do the exact same thing? Twitter could prevent websites from doing that by not allowing CORS, but apps could just ignore the CORS header. If a third party application made those API calls from a central server it would be easy to identify by the number of requests and could be banned / rate limited, but a app could just make the API calls directly from a users device to prevent that.
Even if everything else is impossible, couldn't a third party client just internally run a browser, visit the official website, and extract the content from there?

Answer 1

The first step would be to require all clients to have their own API key and make clients illegal which try to "mimic" the original client by exactly replicating the behavior in order to bypass detection. These requirements are simply part of the terms of API use.

Clients which adhere to these legal requirements can easily be distinguished by their different API keys - so no problems with these.

As for detecting illegal clients which try to mimic the original client and also "steal" the native clients API key: There are several techniques for fingerprinting clients at the TLS or HTTP level or about the order of requests etc. So the illegal client needs to sufficiently replicate all of this and they might have some success with this for a while. But, since the vendor has full control over their own native clients they can change the native clients behavior whenever they want, for example simply by adding a new HTTP header or slightly changing its value. Such unexpected behavior changes allow them to distinguish between their own clients (changed behavior) and illegal clients (previous behavior).

Once detected they can ban the illegal client due to the different behavior. This means that the author/vendor of this illegal clients needs to catch up to the changed behavior which costs time and money and leaves the users of the client annoyingly without access for a while. The owner of the API can also proceed with legal actions against whoever produced the illegal client, because this is a clear violation of the terms of use.

In other words: it is not relying only on technical restrictions but by changing behavior and by legal actions. This makes it costly for alternative vendors to provide their own illegal client. Regular but unexpectedly breaking the illegal client further undermines the business model of the illegal client since unsatisfied customers will leave.

As for some hobby projects which don't get widely used - these don't actually harm the business model of the API provider so it is not worth to chase these. They might still accidentally break if the API provider makes changes.