To clarify further, lets say I want to charge $1 for every 10,000 requests against my API. If someone wants to farm my data for free, they would just need to find another client app that already uses my API and construct requests using the credentials of the paying customer.
I don't see any way that I can "hide" what is going on the client, someone will always be able to easily reverse engineer the "auth" scheme. So what are good ways to mitigate abuse?
More in depth example of the scenario...