congratulations on the launch! are there any checks done on the backend to guarantee that the website using the "init(appId)" call is the right one? The attack

congratulations on the launch! are there any checks done on the backend to guarantee that the website using the "init(appId)" call is the right one? The attack vector here is a fake website - say "userbose dot com" - where the login would be validated by the backend and can now access all data for that user.