I'm struggling to understand how one can secure an API endpoint using JavaScript.
I want to create a copy and paste-able snippet of Javascript that a user can paste in their site. And on page load/s data will be fed back to the application via and API call.
I understand you could have a token behind server side code etc. But I ideally want this to be really easy to use - a simply copy and paste Javascript tracking code snippet.
I also know I can apply throttling and whitelist IP's, Hostsnames and numbers of request within a timeframe. But this is not 100% secure as someone could still spoof this?
How do companies like Google do this? E.g with their Maps API you can whitelist URLS, IPs etc. Is this 100% secure?
Many applications have copy and paste-able Javascipt code that you add to your site that feds data back to the app. E.g. HubSpot etc.
How are they doing this without their API's getting spammed to death? What am I missing here?
(*As a note I'm using Django Rest Framework)