javascript: How to prevent abusive use of public api
<p>I am allowing user to login to my site on the basis of one time password send to the users mobile number.</p>

<p>My problem is that i am doing Api call to send otp to user's mobile number using jquery ajax. Now anyone can see the api call and make infinite api request to my server which will expire my sms pack immediately.</p>

<p>How can i avoid such abusive use of API call?</p>