True, I should have thought through that a little more. The domain could be spoofed, making it less than secure and leaving you open to the same issue. For wh

True, I should have thought through that a little more. The domain could be spoofed, making it less than secure and leaving you open to the same issue. For what it is worth, on our client accessible API, we require clients to authenticate and then send in the token we return through the http header for each request, and the token is reset often. The token is a hash of a few client identifiers, but it is calculated and sent to the client so the client never calculates it. We only allow https for the API. This seems to be a fairly common pattern. EDIT: add link This method is similar to how we calculate our token: http://billpatrianakos.me/blog/2013/09/12/securing-api-keys-in-a-client-side-javascript-app/ http://billpatrianakos.me/blog/2013/09/12/securing-api-keys-...