title: How to secure the communication between API backend and SPA frontend
body: <p>I am working a lot with SPAs*. Therefore I am using API based backends to get the entity data for the SPA-ORMs*. This is simple and works fine.</p>
  
  <p>Now I am working on a private project that will be used by many people. I want to prevent the misusage of my APIs without the SPA. <strong>Are there ways to make it a little harder for the script-kiddies to misuse the API?</strong></p>
  
  <p>Back in my time :D I used to use simple keys to encrypt the data on a very low level. But with the current dev-tools of f.e. chrome you can easily debug anything in the SPA and how the data is getting crypted/uglified. I am just out of options here.</p>
  
  <p>I am not interested in securing the connection, since SSL is good enough for me. The user password security is safe enough too (modern frameworks do good work here). I am just out of knowledge, how to make it harder to use the API without my SPA.
  I am developing both ends, so I am able to make the API whatever I like - do you have tips, best practices, ideas?</p>
  
  <hr>
  
  <p>Footnotes:</p>
  
  <ul>
  <li>SPA = Single page application (like VueJS, Angular, Ember, etc.)</li>
  <li>ORM = Object relational mapping (like VueX, ember-data, etc.)</li>
  </ul>