I prefer to eat my own dogfood. That usually solves the problem. I design the API with two strictures: First: Any API I can use, my customers can also use. Second: Everything I design must use the API. No backend magic. No black boxes.

The rest (no pun intended) is just permissions.