then make the unlock cost money

relatively easy for devs, but hard to scale for scammers

It's either that or as suggested, hard require developer validation for specific API permissions.

[deleted]