I have a javascript placed on third party site and this js makes API calls to my server. JS is publicly available and third party cannot save credentials in JS. 
I want to authenticate API calls before sharing JSON and also want to rate limit. Any one has ideas on how can i authenticate API?
It all depends on what you're authenticating.
If you're authenticating each user that uses your API, you have to do something like the following:

Your site has to somehow drop a cookie in that user's browser, 
Your API needs to support CORS (we use easyXDM.js),
somehow upon logging in to their site, their site needs to send the user to your site to have a token passed that authenticates the user against your API (or vice versa, depending on the relationship). 

If you're just authenticating that a certain site is authorized to use your API, you can issue that site an API key.  You check for that API key whenever your API is called.
The problem with this approach is that JavaScript is visible to the end user. Anyone who really wants to use your API could simply use the same API key. 
It's not really authentication without some sort of server to server call. At best, you're simply offering a very weak line of defense against the most obvious of attacks.
how to do authentication of rest api from javascript, if javascript is on third party site?