I'm trying to create an API with minimum forced structure. The messages can come from end user device or from a backend server. I'm ok with opening separate API for end user traffic and from servers. The client are web and mobile companies that can send their data to the API. (Think google analytics for websites, mobile application and events from web servers) What will be the best practice to know that a http request to the API got from a trusted client? If there is any good article in that manner, that what be great also.
-- EDIT -- What will be the best practice to authenticate the client (not the end user)