title: How to prevent arbitrary client apps from using anonymous web API?
body: <p>Apologies if this has already been asked and answered; I've looked around a bunch but haven't found exactly what I'm asking.</p>
  
  <p>--</p>
  
  <ol>
  <li><p>Suppose my web app at <a href="http://example.com/" rel="noreferrer">http://example.com/</a> uses a private and undocumented web API at <a href="http://api.example.com/" rel="noreferrer">http://api.example.com/</a> to fetch data, e.g. via XHR or JSONP.</p></li>
  <li><p>Also suppose that this web app is anonymous &mdash; it does <em>not</em> require user login.</p></li>
  <li><p>Since there's communication between client and server, anyone can open Fiddler, etc. to see the exact request and response, not to mention inspect the client-side JS code.</p></li>
  </ol>
  
  <p>In a case like this, how can you prevent someone from using your API in a <strong><em>non-web</em></strong> client app? E.g. an iPhone app, or server-side.</p>
  
  <p>To my understanding, point #2 removes the option of something like OAuth, and point #3 removes the option of e.g. API keys or even SSL.</p>
  
  <p>I've thought about things like time-based tokens or secret salts that are injected into the page on first load, but an iPhone app could easily just secretly load your webpage before making API requests.</p>
  
  <p>So is there any way besides just plain obfuscation &mdash; security through obscurity?</p>
  
  <p>--</p>
  
  <p>In case all that is too abstract, here's a simple example:</p>
  
  <p>Google.com fetches its auto-complete data via some API that's private and undocumented &mdash; but open on the web. What's to stop me from using it in my iPhone app?</p>