Something like this [0]. The point would be to force clients to deliberately circumvent the restrictions, which I believe would give them more standing to go after 3rd party clients that attempt this.

Worth noting that most browsers don’t support token binding yet, but this has been in the works for awhile, so I’m mentioning it here for illustrative purposes. They could theoretically implement something less airtight but with the same general goal.

- [0] https://datatracker.ietf.org/doc/html/rfc8473

Both Apple and Google will remove apps from their store if they access a 3rd party API without consent. Not to mention that if using non sanctioned APIs you will likely face lawsuits from whatever service you are implementing a 3rd party client for.

It's a game of cat and mouse, it's like anticheat, or user agent spoofing. All reddit have to do is make it "difficult" enough to dissuage the majority of users for it to be worthwhile.