Generate secret tokens that the server can validate using some heavily obfuscated process. Compile the JS to WASM.
If you can use HTTP3 or WebSockets that's a bonus, because you can create a custom protocol that does some secret handshake before sending the goods.
Their approach is to make a blob of code which collects all kinds of details about its environment (for example, Object.keys(window) ). It then uses a hash/concat of those details (with some random too) to decode data to decide what else to collect, hashes or concatenates those in too. Repeat a few times. Then send the final data blob back to the server.
The server can then run a tiny emulator to run the code with the same seed random to check the results are the same on a whitelist of allowed environments.
Both use some wacky methods for request signing that include encrypted code, obfuscated control flow, hashing the browser environment, ...
Assembly obviously allows for much more powerful obfuscation than Javascript. Webassembly is somewhere inbetween, but a viable path since it is pretty universally supported by now.
Networks requests can be inspected trivially in the browser though, which makes things a lot easier.
I haven't seen anything like that in the wild, though.