To be honest most of the rest applications I have developed have been intranet applications so I have not had to worry about scrapping data by others. In the past I have primarily used server side frameworks like ASP.NET/PHP for public facing websites/applications, which would render html output rather than a JSON document.
I obviously cannot provide a shared secret to be stored in the client side to generate a authentication token.
I could think of enforcing CORS headers on the servers to only allow requests from my own domain, but then again nothing stops people from viewing the network activity of this website and getting hold of the endpoint and pinging the endpoint directly from their own client.
I could make use of a short lived access token that my server would hand over only to a valid request from my own website frontend.
But then again nothing stops people from grabbing this token from just refreshing my website and passing on this token to their client.
Also think like host headers, user-agent, etc can be easily spoofed.
I could potentially issue a HTTP cookie to my own domain and each time validate http requests against this cookie. But since I'll also be making ajax calls to the servers my own requests could not be honoured as my scripts also cannot access HTTP only cookies ?.
The best I could do is restrict CORS allow-access setting to my domain name, I do understanding preventing scrapping is a very daunting task, but my view is scrapping a api that returns JSON data would be a much simpler task than say scrapping a HTML output from the server.
Would you recommend the SPA model with a REST api backend for developing such public facing applications that does not require authentication ?