In theory, yes, but instances don’t ship with the ability to do that. There would need to be a change to the Lemmy code base if such a thing was to be seriously implemented.
I’m no federation expert, so I can’t really comment on whether doing something like requiring API keys would be feasible, unfortunately.
The opposite; the API to simply take comments and posts in bulk is free and open.
Can an instance close the API or limit it?
In theory, yes, but instances don’t ship with the ability to do that. There would need to be a change to the Lemmy code base if such a thing was to be seriously implemented.
I’m no federation expert, so I can’t really comment on whether doing something like requiring API keys would be feasible, unfortunately.