APIs and other resources, especially physical but internet-connected ones, can restrict access by location. The location can be cyber, but it is sybil resistant because POW is needed to arrive at the location, and the path is verifiable, and the path is tied to an unforgeable identity.