I want to build an Ethereum app that gets weather data from a trusted (government run) API via oracilize. This service requires an API token to be sent with each request to prevent abuse. Each API token is limited to a per-second and per-day number of requests.
It is free to make a call to their API, and getting an API token is free. You just enter your email address into a form, and they immediately email you a token.
Hard coding an API token into the contract won't work, because an attacker can take the token and spam their API over the per second rate, causing my app to break.
I was thinking that I could do a convoluted thing where I get oracilize to create an AWS instance, which would in turn programmatically create an email account with some free service (not sure if this is actually possible), provide the new email address to the API token creation form, and then get the token from the email address's inbox and make an API call. This would have to happen every time an API call needs to be made.
But I wonder if even that is still insecure? Like maybe an attacker could subscribe to an event and could still manage to get the token and spam the API before I can get the data I need.
Are API tokens completely incompatible with ethereum apps? Or is there some way around this issue.