I am building an IoT platform that should receive data from a Raspberry Pi over a REST API. Assuming the platform could in the future be used to manage multiple devices of multiple users, my question is, how the device should be assigned correctly (and securely) to the account of the user who owns the device. The simplest solution would be to issue an access token that is linked to a user and a device, which is then manually (e.g. with a Bluetooth app) deployed to the device. Whenever the device sends data to the server, the access token ensures, that the data is associated with the correct user account.
However, this method does not prevent the user from logging manually to the server e.g. using a python script. I was thinking about a private/public key mechanism, that could ensure, that only the device with the correct private key is able to post data to the server. I also have an idea about how to implement this, but my question is, is this really needed? Is it a problem, if users can log manually (without the device) to the server? Does it matter, what data is sent to the server if the API post includes a valid access token?