Prevent attack to api

you can set expired times to your token and disabled caching might give you little help

---
but the real question is , how he can took your token?

#he got my token from sql injection

so that's not your token problem, but your apps problem

#noo, he got my token from sniffing

so, you need ssl /https


https://www.smashingmagazine.com/2017/04...p-headers/