Oauth was mentioned in some of these comments. I'd add to that to use generated API keys and rate limit requests per key. Or per user.