In general, this is hard to do. This is because, as you say, the recipient can reverse engineer anything you send down to the client.

See http://craphound.com/msftdrm.txt:

> In DRM, the attacker is also the recipient. It's not Alice and Bob and Carol, it's just Alice and Bob.

What applies to DRM applies to your webapp as well.

The best you can do is make this inconvenient: lock it down by IP range if you can. Make the javascript hard to reverse engineer (there are encryption tools out there). Have the API ask a question only a user would know. Password protect access to the app before you ever send javascript which accesses your web service. Do all this over SSL.