Why You Should Never Trust the Client: Server-Authoritative App Architecture

Use trust boundaries, authorization, validation, idempotency, transactions, and server-owned rules to keep mobile games and APIs correct under tampering and retries.