> Use SSL for the requests which makes it harder to sniff the API. Won't help - it's trivial to setup a proxy to MITM the traffic. > Use a specific User Agent

> Use SSL for the requests which makes it harder to sniff the API. Won't help - it's trivial to setup a proxy to MITM the traffic. > Use a specific User Agent string and check for that. Won't help - it's easy to manipulate a User-Agent. Assuming you're manually creating the GET request (via cURL or other means), then it's only one more option to bypass this. > Provide no error messages if any of the above fails. Will make debugging a pain. Also, if I'm an attacker, I'm going to try and clone the request as best as I can the first time, then see what I can get away with. > Add some sort of tamper token like you suggest. This is the best option. Not quite sure the best way to implement it, but perhaps some sort of CAPTCHA (this would be a pain), or some kind of random request id, etc. might work.