如何保护网络服务呼叫

Question

I am developing SaS based application where users can call the api from their websites. Basically it can be called from static websites. How to secure the web api call without getting spammed and allow it to be called only by the registered users.

Answer 1

There are many possibilities to secure web services. However, the basic idea is to give clients a clientId. Each time when a legit client (holding the clientId), logs in, it provides that clientId, username and password which is checked against a database. If clientId is there, then the username and password get validated.