This is clearly a tricky area for new app developers to navigate. Whilst researching I found this post.

I've now found three ways to build support for my users to post to their WordPress sites:
1. Our own WordPress app with wp_insert_post - https://codex.wordpress.org/Function_Reference/wp_insert_post
2. JSON API which only works with wordpress.com and Wordpress instances with jetpack installed - https://developer.wordpress.com/docs/oauth2/
3. XML RPC wp.newPost which some sysadmins (see comments above) turn off - https://codex.wordpress.org/XML-RPC_WordPress_API

Hope this helps others who find their way here. Please correct if not a correct understanding!