1. Use the current GMT date/time to generate an encrypted api point like adfa923asdf.yourdomain.com.
2. Make it change every day.
3. For all other hostnames besides the correct one for the day, dump random data so the fake app cannot tell whether or not the api is giving out the right results for sure. All your apps will be pining the right api end point where as the fake ones will have a hard time catching up.
Have you tried your hands at mobile / desktop app development? Or, is that not your thing?
I think the chances of having a hit is much more in the mobile space than on the web. I think the web is getting too crowded too fast and it's really hard to get people's attention. It's much easier to do so in the iOS/Mac world.
BTW, I am in a situation very similar to yours. Good Luck!
1. Use the current GMT date/time to generate an encrypted api point like adfa923asdf.yourdomain.com. 2. Make it change every day. 3. For all other hostnames besides the correct one for the day, dump random data so the fake app cannot tell whether or not the api is giving out the right results for sure. All your apps will be pining the right api end point where as the fake ones will have a hard time catching up.
Also, use authentication on top of all of this.