Looking for the latest information on controlling user API access, as the last post I see is from 2013, where the best advice was essentially to audit the list of connected applications periodically. Every time I audit that list I lose a few days off my life, so I am hoping that there are better options now.
Specifically, using connected apps with the new-ish API client whitelisting functionality appears like it might provide granular controls.
What I need to understand is whether I, as an admin, can create a connected app for any oAuth endpoint, thereby having complete control over which apps can be used by which user.
Or, does the connected app need to be provided by the app developers, in which case if a user needs access to an app that does not come with a connected app, the user must be granted the 'Use any API client' permission, which would give them access to all apps.