I have made a contact form that uses AJAX to submit, but when sending the data it shows up in the network tab, with this people can spam the contact form by directly sending data to that address with the correct data. How can I prevent this? I saw something about a token system, but that would show up in the post request aswell.
Thanks in advance
That's not possible. You can certainly obfuscate things (and for example, if you're sending a proper POST request, you won't be able to see the values being sent, just the endpoint URL), but if you think about it, you need to eventually tell the client where it can submit its query to, and the user always has full control over the client, so they'll always be able to see that.
In reality, this is a non-issue because you can trivially invalidate requests that you don't want. For example, on your server you can check that they send some token which expires after some amount of time along with their request, or you can e.g. block all requests from a single IP address if they send too many in quick succession, etc.
You mention that this is a contact form --- I'm sure on the internet you've run across reCaptcha input fields (where you have to solve a trivial problem like selecting all of the traffic lights in a grid of pictures), and they exist to solve the same problem of proving it is an actual human submitting each request. I'd recommend looking into that if you want a simple solution and don't want / need logins.