As others have mentioned in the thread, this doesn't guard against a MITM proxy and it'd take a couple minutes to defeat this. You're much better off proxying

As others have mentioned in the thread, this doesn't guard against a MITM proxy and it'd take a couple minutes to defeat this. You're much better off proxying calls from your own server API, having proper rate limits and authentication, and a strict API surface that doesn't permit arbitrary calls to whatever APIs you depend on