I don't disagree maker API Logs are fairly useless in this situation.
You are thinking about it from a researching perspective. The information you need from the app to identify the source.
I am thinking about the app/instance itself being the tag to identify the source. You wouldn't need to look at logs or anything else to see who the source is. You would know exactly who it is by the fact that app was called. Ofcourse you need to setup your stuff that way to begin with so after the fact that isn't helpful.
Where this fails is when a app is removed but the Cloud Service isn't stopped. That is when you would get the message from the system about the app not existing above. But then you get the path and IP of the source for the call.
I am not sure that would really help much. For instance in my test with my browser it would of said "Mozilla something" for the agent. The path would just show what was called which is what would be on the app examples page minus the host URL, and then http method would of been a POST. I am not sure how that would help identify the source.
I would think requiring a Header that is specific to the service. Maybe simply a identifier would be the way to go. but that would be breaking potentially.
Another possible idea is to make tokens a manageable resource outside of the hub. Instead of it being determined inside the Maker API Instance they are created and managed at the cloud layer for cloud use.