Protecting the token on the client side?

Question

API

What are the ways to protect the token on the client side?
Let's say there is a website, on the front, at a certain event, a request is sent to a third-party service for storing data, and so I'm interested, any ill-wisher can simply copy the token and, for example, clear the storage.
example url with a token:
https://example.com/4508hghgh34g87r34545/get - read
https://example.com/4508hghgh34g87r34545/set - write
what tools can be implemented in the service to protect against simple copying?
Naturally, in addition to CORS, it is included.
I'm more worried that the user can send a request to overwrite data directly in the console.
In general, it is interesting to learn the world practices of protecting the token on the client

Answer 1

I'm more worried that the user can send a request to overwrite data directly in the console.

Everything that went to the client - you no longer belong.
If you want to somehow get attached to the business logic of your project, your statuses, etc. - write a mini service on your backend that will forward requests to an external service, at the same time doing all the necessary checks for business logic, etc.

Answer 2

Authorization. Divide and rule.
There is no need to give each cross-counter more rights than he needs to perform everyday tasks.
To perform rare tasks, you can require authentication again. Haven't you ever met - you can do anything on the site, but when you change key information in your personal account, you are required to enter the password again.

Answer 3

The essence of the token is to prevent access to its contents under any circumstances.
Data enters, is processed, exits. Everything. He is a black box. No requests and persuasions can be considered something from it. So

I'm more worried that the user can send a request to overwrite data directly in the console.

even reading its contents (key, certificate) is a sufficient condition for compromising.
Therefore, in reality, the token is a separate service, inaccessible from anywhere, that receives data and returns the processed data. How he does it must be a mystery.