To best explain my context, imagine that I’m creating an alternative piece of software to google analytics (since my personal project’s principle is similar). Each unique user creates an account and needs to place a tracking script on their website so that their website visitor actions can be tracked. Something like this in the head:

<script defer data-domain="testing.com" src=“url/path/to/my/website/script“></script>

The script needs to make an API request to send the data to the server for processing. As the script would be on every page of every customers’ sites, there would be a lot of API requests. I worry that if a customer stops paying but leaves the script on their website, it will still make API requests, hence I need a way of rejecting the API requests.

I’ve been reading around and am trying to figure out the best way of preventing unauthorised use of an API. Ideas that have been raised are using an auth token, API key/secret, and throttling/rate limiting, and tracking IDs for convenience. Would using an auth token be:

  1. Possible, since assume the user can place their tracking script on their site only once, and JWTs will eventually expire. Would it mean that the script would no longer work? Or could they renew their JWT?
  2. Necessary, and;
  3. Required in order to check whether the customer is still paying and decline the API requests if not?

If it is not possible to use an auth token (since it would expire), could the request just use the website URL origin (since each user has a unique website URL), find the user associated with that account, check whether they are a paying customer and decline their API requests accordingly?

Are there any better approaches to this, or any suggestions that anyone has? I wonder what companies like Google etc do.

Presumably even rejecting API requests costs money since my server would have to respond with a 401/403 error, but presumably nothing can be done about this as the script installed on customers’ sites has to have a src attribute that points to the script path on my server. This still concerns me since there could be a large amount of even declined API requests.

FYI, the client-side script uses javascript, my server uses node and GraphQL Apollo server for the API. I would not be able to prevent non-paying customers from removing the tracking script from their websites.

Thanks - any suggestions would be much appreciated.

2 Answers 2


Google Analytics just uses a single ID. Here's an example of Google Analytics.

You could also add Referer checking to see which site is loading the script.

could the request just use the website URL origin (since each user has a unique website URL), find the user associated with that account, check whether they are a paying customer and decline their API requests accordingly?

I think that's the simplest approach and could probably be done with a single database query. If you do this as early as possible in your processing you can reject bad requests.

But in general it's not possible to stop people making HTTP requests you don't like or don't want to pay for. You can only make it so there is no advantage they can gain by doing so, at which point they won't bother.

  • that is a good point. Would using auth tokens even be possible since the users would just embed the script on their site? It sounds like it may be better to expose a public API. Would a limit on API requests best prevent abuse? Also I wonder why the GA script uses an ID when it could presumably just use the website origin URL? Mar 9, 2023 at 22:45

I don't believe there is anything to gain in rejecting the requests from the data-gathering client-side script. Nobody is going to care what response that script got to its request or even if it received any response at all. And the costs for the bandwidth you will have to pay anyway.

A better approach is to store only the information that is useful for the owner of an active account. In the majority of the cases, that would be information that is relevant to the website owner who included the client-side script, but it could also be information that is useful for you.

Why would a website owner then pay a subscription fee to you? They would have to pay in order to get access to the information that you gathered on their behalf.

  • I was advised that rejecting requests would decrease costs: processing a request for a non-paying customer would presumably cost more than declining the request since it would need to insert into the DB etc. How would there be nothing to gain? Also there are GA alternatives that charge, such as Plausible, although my project is unrelated Mar 9, 2023 at 22:32
  • @user8758206, processing a request from a non-paying customer (or even a non-customer) could be as simple as: Check if the request belongs to a valid domain. If not, discard the data and return a success response. The only difference with a rejection would be the response code you return. Mar 10, 2023 at 7:26
  • If the request is rejected then it wouldn’t need to insert the data into the various tables in the database, which is presumably an additional expense Mar 10, 2023 at 8:10
  • @user8758206, accepting a request does not imply that all kinds of data are stored or updated. It only means that you respond with a 2xx status code. Mar 10, 2023 at 8:20
  • In this case my app would process and store data if the request is accepted. If it is rejected then there would be no need to do so, so presumably rejecting the request would have the benefit of saving the process costs Mar 10, 2023 at 13:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.