If you have a web API it's impossible to secure it, especially when you have many platforms that access it ( web / mobile ect ... )

You can change it often enough to be really annoying though. And Whatsapp bans users of third-party clients it can detect. At least the users I know stopped trying these things after a while.

They "secure" it through legal force. Many startups are shut down by legal threats based on the CFAA, which effectively makes it illegal to talk to a server after you've been informed that you aren't allowed to do so (ordinarily, this information is conveyed through the Terms of Service -- a C&D is typical but not strictly required).

Let's hope it does not take them much, because I don't like spam.

There are much easier methods to spam, and they're very good at dealing with them.

This is only useful for real users who want to write custom applications that connect to their phones.