Token Bucket VS Whoops

Well, there isn't a way to fully prevent reverse engineering/web scraping of an api. You can make it so a user can only access/delete their own data by using a PHP session and validating the token sent to the server before sending any data back or performing an operation. You can protect yourself from dos requests by rate limiting access for each session to the api. Also, sanitize and validate all user input.

Does this help? bandwidth-throttle/token-bucket: Implementation of the Token Bucket algorithm in PHP. (github.com)

To get the full control of the error output (or, rather, of the error message handling) I would suggest to use an exception handling function, set_exception_handler() I've got an example in my article on PHP error reporting. There, instead of just spitting out the raw exception, you can use the Exception class methods to get the relevant parts and either log or echo them out, depends on the server role. Or you can even include a library like Whoops that dramatically improves the output.

Check out spatie/laravel-ignition (if using Laravel) or filp/whoops

I've been using whoops but it's a bit stale (not even 7.x or 8.x native, just compatible with those but still very much 5.x code). Might have to explore ignition.

To give an example of what I am looking for, there is this library for PHPT: http://filp.github.io/whoops/

You're correct about it being a faulty webpage, but that's now what any browsers devtools look like. What you're seeing here is a whoops error page from an older version of Laravel.