I am working on a Laravel app where I am building some API for other websites. But I am trying to make the implementation of my API as easy as possible. My expectation is that the user will only use this tag in the HTML head:

```
<script src="api.mydomain.com">

```

Now I have a controller on this URL that provides the source javascript with the content-type header, but before it goes there, the router will first execute my authentication middleware. Let's say it looks something like this:

```
public static $users = [
    'client1.com',
    'client2.com',
    'client3.com'
];

public function handle(Request $request, Closure $next)
{
    $origin = "HERE I NEED THE ORIGIN URL"; // e.g. client4.com

    if ( !in_array($origin, self::$users) ) {

        abort(401);

    }

    return $next($request);
}

```

As you can see from the code, I need to retrieve the **$origin** variable. So if a website *client1.com* will try to insert my *javascript*, it will successfully get the javascript code. If *client4.com* tries to access it, it will get a 401 error.

I found out methods with **$\_SERVER['HTTP\_REFERER']** or Laravel's **$request->server('HTTP\_REFERER')**, but this data might be spoofed, right?

In the best-case scenario, I would like to retrieve the original domain and when not available (e.g. from a private cURL request), I would like to get the IP address. And of course, I need it to be secure - clients1/2/3 paid for my API, others didn't.

How can I do it? Or is there any better method for origin authentication?