We have an API openly accessible through a data visualization on a website and an app. We'd like to make the life of potential data scrapers a bit more difficult.
First thing we did was to add some throttling, but in our case the line between legit and malicious request rate can be blurry. It also doesn't keep scrapers from taking their time.
It's currently easy to see how our requests are built and create new ones, so we thought of making this more difficult by generating some kind of hash using chosen values (request parameters, current time, value in cookie, etc.) on the client side and checking it server side. The code generating the token would naturally need to be obfuscated on the client side.
So the question is, how useful can such a protection be? It appears to come down to how much we can obfuscate the token generation. How efficient is this, particularly in javascript?