How can I block unwanted clients from accessing my API?

This question comes up a lot! The reality is that anything you implement can potentially be spoofed by someone with enough motivation. For example, if your app indicates it's a specific version, someone could easily pretend to be that version. While stopgap measures exist, they can often be bypassed. Instead of just blocking clients, I'd suggest you clarify what you're specifically trying to prevent. Understanding your goal might lead to more effective solutions.

I've tackled a similar issue before. One effective method we used was implementing an HTTP client certificate challenge. This, in combination with enterprise security software and strict admin controls, helped prevent users from easily accessing or replicating the required certificate. However, if you don't have full control over your client devices, it becomes much tougher to prevent unwanted access.