See the details in my comment. The same way you would require authentication and/or signing on any request, on any modern platform. Not doing this is poor form.