I also know I can apply throttling and whitelist IP's, Hostsnames and numbers of request within a timeframe. But this is not 100% secure as someone could still spoof this?
How do companies like Google do this? E.g with their Maps API you can whitelist URLS, IPs etc. Is this 100% secure?
Many applications have copy and paste-able Javascipt code that you add to your site that feds data back to the app. E.g. HubSpot etc.
How are they doing this without their API's getting spammed to death? What am I missing here?
(*As a note I'm using Django Rest Framework)