A method implemented in a computing device for securely obtaining services from a service provider separate from the computing device, the method comprising: receiving, at an application programming interface, API, on the computing device, a request for a service, the request originating from an application executing on the computing device and including personally identifiable information, PII of a requestor; sending, by the API, the request for the service to a third party provider system separate from the computing device and the service provider; receiving, by the API, a response from the third party provider system, the response including an authorization result indicating that the request for the service is authorized; generating, by the API, anonymized information corresponding to the PII; modifying (352, 354, 356), by the API, the request for the service by replacing the PII in the request for the service with the anonymized information; and providing the modified request for the service and the authorization result to the application for transmission to the service provider (510, 630); wherein sending the request for the service to the third party provider system includes sending the request for the service to an application program provided by the third party and configured to be executed on the computing device; the method further comprising: comparing, by the application program, the request for the service to known fraudulent requests and requests from known automated agents, bots; comparing, by the application program, one of a machine unique identifier, MUID, and an Internet protocol, IP, address to a blacklist of known fraudulent or bot MUIDs and IP addresses; and generating the response indicating that the request for the service is authorized when the request for the service does not match either a known bot request or a known fraudulent request and when neither the MUID nor the IP address is in the blacklist. receiving, at an application programming interface, API, on the computing device, a request for a service, the request originating from an application executing on the computing device and including personally identifiable information, PII of a requestor; sending, by the API, the request for the service to a third party provider system separate from the computing device and the service provider; receiving, by the API, a response from the third party provider system, the response including an authorization result indicating that the request for the service is authorized; generating, by the API, anonymized information corresponding to the PII; modifying (352, 354, 356), by the API, the request for the service by replacing the PII in the request for the service with the anonymized information; and providing the modified request for the service and the authorization result to the application for transmission to the service provider (510, 630); wherein sending the request for the service to the third party provider system includes sending the request for the service to an application program provided by the third party and configured to be executed on the computing device; the method further comprising: comparing, by the application program, the request for the service to known fraudulent requests and requests from known automated agents, bots; comparing, by the application program, one of a machine unique identifier, MUID, and an Internet protocol, IP, address to a blacklist of known fraudulent or bot MUIDs and IP addresses; and generating the response indicating that the request for the service is authorized when the request for the service does not match either a known bot request or a known fraudulent request and when neither the MUID nor the IP address is in the blacklist. comparing, by the application program, the request for the service to known fraudulent requests and requests from known automated agents, bots; comparing, by the application program, one of a machine unique identifier, MUID, and an Internet protocol, IP, address to a blacklist of known fraudulent or bot MUIDs and IP addresses; and generating the response indicating that the request for the service is authorized when the request for the service does not match either a known bot request or a known fraudulent request and when neither the MUID nor the IP address is in the blacklist.