My understanding is that API is just a convenience implementation of app-level users, which are a common app feature which is tedious to implement. It is up to the app to figure out what each user may or may not do. sqlite itself has/does no sort of user authentication, but it does offer an encryption option *with a license fee*: <https://www.sqlite.org/see/doc/release/www/readme.wiki>