Hi @Romchela,
Let me explain my use case better.
I want to protect a specific API endpoint against some kind of brute force attack. The attacker would hit the endpoint directly.
I've done a hackfix that is just adding some hash to the request from the website so I know it's coming from there and the endpoint does not work if hit directly (or the attacker reverse engineered my hack).
Now if the attacker was to use some headless browser I would be in trouble, because the request would come from the actual website, right?
In that situation, the solution is to make sure your user is human, right? So far the main solution is to add a captcha, which I would like to avoid.
BotD is interesting because it looks like an alternative (not sure how it works compared to google invisible captcha though), however it lacks protection against replay attacks.
As an attacker, you could visit the website, capture the legit request ID, and then tweak your attack so you hit the endpoint directly with this legit request ID for all endpoint requests.
Google captcha prevents this because it invalidates the request ID once it has been verified (on top of 2 minutes expiring lifetime).
Basically I would like higher protection on specific endpoints rather than light protection on my API as a whole (like captcha)

Got it. We've already thought about this kind of attack but didn't have time to implement this. I will ping you when we found a solution. Thanks!

Excellent! I'll check it out. Thanks for the update :)