title: How to protect a private REST API in an AJAX app
body: <p>I know that there are many similar questions posted, but none of them refers to an HTML/javascript app where the user can access the code.</p>
  
  <p>I have a private REST API written in nodejs. It is private because its only purpose is to server my HTML5 clients apps (Chrome app and Adobe Air app). So an API key is not a good solution since any user can see the javascript code. </p>
  
  <p>I want to avoid bots creating accounts on my server and consuming my resources.</p>
  
  <p>Is there any way to acomplish this?</p>