There is no better case study for this than Pokemon Go, where the interest in spoofing location reached unheard of levels (outside of state actors). This is a good writeup:

http://engineering.shapesecurity.com/2016/08/pokemon-go-api....

Basically sign your API requests with the most obscure function of phone context variables imaginable, and recognize that if you get so popular that it's cracked, you can just hire a machine learning team anyways. And pin your certs!