Prevent multi upload with users

Got it.

So you are worried that if hacker knows endpoint URL, username and password, they can just keep uploading?

CodeIgniter CSRF protection might help, it won't stop them posting data at your server, which could become DDoS issue on it's own, but it will help you to filter out valid requests and ignore the rest.

No my problem is not file type or content
My problem is only upload file from app and prevent upload file with username and password with restful tools or php
I try prevent with useragent or api key special for mobile but it is not necessary