If your API is meant for other developers to build-upon, you use public-keys and registration, just like how you registered to use Google/Facebook login. You s

If your API is meant for other developers to build-upon, you use public-keys and registration, just like how you registered to use Google/Facebook login. You should also sanity-check your GET/POST requests, to make sure they contain ONLY what is allowed. There are many other things you can do, but I can't think of them right now.