1. A computer-implemented method comprising: receiving a first application programming interface (API) call by an installed application on a device; determining a sensitivity level of the received first API call; when the determined sensitivity level of the received first API call is associated with a restricted API classification, determining whether an author of the installed application is an authorized author by determining whether a Secure Sockets Layer (SSL) certificate used to deliver binary code of the application to the device using an SSL protocol during the process of installing the binary code of the application is owned by a trusted entity or has been validated by a trusted entity; and when the author of the installed application is determined to be an authorized author, allowing the received first API call access to its associated API.