Hello Team,
I’m working on creating a public API for each customer on our platform, which will be used to power our widget. While this approach works well for integrating the widget, I’ve identified a potential issue:
The API key used for the widget is exposed publicly. This means we can track its usage when it’s invoked legitimately via the widget. However, if someone uses the API externally (outside the widget context), we won’t be able to determine or control that unauthorized usage.
To address this, we need a solution that:
Allows us to distinguish between legitimate widget requests and external API calls.
Provides a way to restrict or monitor unauthorized external use.
I’d appreciate your thoughts on how best to implement this. Possible approaches could include token-based validation, referer checks, or other measures to enhance security while maintaining usability for the widget.
Looking forward to your feedback.