Setting up a same-origin policy (https://developer.mozilla.org/en-US/docs/Web/Security/Same-origin_policy https://developer.mozilla.org/en-US/docs/Web/Security/

Setting up a same-origin policy (https://developer.mozilla.org/en-US/docs/Web/Security/Same-origin_policy https://developer.mozilla.org/en-US/docs/Web/Security/Same-o...) would prevent people from embedding the image in other websites. You could try generating a unique token for each page-view, and use this as an access-token for all other resources pulled by the page. The reality is that it's not too many people who will misuse your API... so don't pick a mechanism that will place undue load on your server until you really have to.