title: Protect a public API
body: <p>After reading around it appears that trying to protect a publically accessible API (API used by an app/site that does not need a user to log in) appears to be fruitless, e.g. store key in app, user can reverse engineer app.</p>
  <p>My question relates to how one can protect as much as possible and slow down abuse of a public accessible API...</p>
  <p>Rate-limiting? Check request origin (although can be spoofed).... anything else?</p>
  <p>Also if the site is SSR, could it just be protected by the server's IP?</p>