Haa! Copied the wrong one. Fixed 
Yeah, obscurity won’t work much given that the endpoint NEEDS to be known for the frontend.
I like @muratcorlu’s one-time code suggestion.
Thinking about it again…isn’t this a classic captcha problem? Yes, captchas are solvable for bots. But their job is to just make things so expensive for them that it doesn’t pay off anymore.
Just finding the magic link endpoint and filling in the right forms…easy. But having to do proof of work every time? Well…might just not pay off anymore.
Edit: I am stupid. That wouldn’t work on the API route anyway 