There is a way.

You create an account with a posting key with a weight of 40, and for each new user you have a private key and a public key created. This account will have a weight of 1. Then, when the user logs in with your API, they will see the public key and the original account name will be hidden. The user then logs in as if using their own public and private keys. For content, you only return the content that was signed with the user's public key. And for publishing, they will end up sending a multisign request with their key, and the main account will arrive at your server. If it's new content, it's accepted; if it's for editing, there will be a check to see if it was signed with their key.