I've got a php registration script, that just takes all the data as a post request. I've got another page which sends that data to the script using jQuery ajax. How can i be sure, that the request came from that page, and not a spammer that would just send post requests to that script. I thought maybe using a token that's in the data sent by the page or a cookie, but both would be easy to discover.
Fundamentally, you can't.
The only way to protect the code is to run it on the server... But this means that every request must go through the server, not just the "valid" ones from your script.
All you can do is raise the bar of complexity.
Another option, as mentioned in the comments, is to use a captcha.
Another option is watching source IPs or patterns in the requests.
But. fundamentally, there is no way to validate that the user is running your code vs their own code on their own device.