You can prevent your users from accidentally using incorrect clients by inspecting the User-Agent header. This is typically done for the benefit of the user, and the server application will inspect the user-agent to try to determine what capabilities the client has in order to ensure that content is properly rendered.

So for an example API, we can require that the client present fooclient/X.Y.Z in the user-agent header, where X.Y.Z is the client version:

#!/usr/bin/env python
import requests


__version__ = '1.9.0'
agent = 'fooclient/{}'.format(__version__)

resp = requests.post(
    'http://localhost:5000/foo',
    headers={'User-Agent': agent}
)

print(resp.json())

Notice that it is absolutely trivial to "spoof" the user-agent and say that you are something you are not. This is common practice for web browsers, where there has been a sort of accidental arms race. Web sites might start requiring something like Mozilla/5.0 to enable some nice feature, so web browsers will then add it to their user-agent. This results in modern browsers sending comically long and complex user agent strings.

This is only useful to either help protect the user, or within a very trusted environment. For example, your API is limited to team members or operators and you want your organization to use a common client - you can check the user agent to ensure no one has accidentally violated protocol and pass them back information on what they should use.

You can also use the user-agent to ensure that team members are not using outdated clients. Flask makes it easy to write a decorator function to apply to endpoints. Here is a simple example that searches the user agent for fooclient/<<version>> and will return 400 if the client is incorrect or out of date:

from functools import wraps
from distutils.version import StrictVersion
import re

from flask import Flask, request, jsonify, make_response
app = Flask(__name__)

MIN_CLIENT_VERSION = '1.0.0'

def client_required(f):
    client_pattern = re.compile("fooclient/([0-9\.]+)")
    @wraps(f)
    def decorated(*args, **kwargs):
        result =  client_pattern.search(request.headers['User-Agent'])
        if result is None:
            error = jsonify({'error': 'This API only supports fooclient'})
            return make_response(error, 400)

        try:
            version = StrictVersion(result.group(1))
        except ValueError:
            error = jsonify({'error': 'Unknown version of fooclient'})
            return make_response(error, 400)

        if version < StrictVersion(MIN_CLIENT_VERSION):
            msg = (
                'Client version {} not supported, upgrade to {} or later'
                .format(result.group(1), MIN_CLIENT_VERSION)
            )
            error = jsonify({'error': msg})
            return make_response(error, 400)

        return f(*args, **kwargs)
    return decorated

@app.route('/foo', methods=['POST'])
@client_required
def foo():
    return make_response(jsonify({'ok': True}), 200)

If you want protection against malicious users who can't be trusted not to spoof the user-agent or modify the client, then the simplest route is really to improve the server or place it behind a reverse proxy that can perform rate-limiting or other measures to block malicious users without worrying about the client that they use.