I'm building a web extension that will be a wrapper for a public API. There aren't any paid tiers for the API currently, but I'm trying to secure the API key so it doesn't get stolen and used outside of my app. I'd like to avoid having my permissions denied.
I currently have 2 ideas that would allow me to do such a thing:
Have the API key in plaintext in the web extension and hope that people are nice enough to not steal it using CRX Viewer (unlikely).
Proxy all API requests through a web server and append the API key server side, returning the results from the API via my proxy to the client.
I'm a fan of Node.js and would like to pursue number 2. How do I go about securing my API in Node.js so that people can't just reroute their requests through my server to the API instead of directly to the API with a stolen key?