So encrypt the request and send it encrypted to the server, checking the integrity of the data to make sure it is unchanged. Include browse time in the request so that the attacker doesn't send the same request. Analyze the IP of the request so that it doesn't repeat itself. If you add additional data (about the user's behavior, when he opened the ad, how much time he spent, how he behaved in the application) it will be difficult to fake such a request and you will know if this is a live person or a bot.
The more complicated you make it, the harder it will be to break in.
The more complicated you make it, the harder it will be to break in.