title: REST API: user-agent-based client (app) authorization
body: <p>I have two separate web apps: </p>
  
  <ul>
  <li>database API </li>
  <li>and basic web-client (Flask) with some JS-code (Knockout.js) for interactive
  features like filtering products 'on-the-fly', cart, etc.</li>
  </ul>
  
  <p>To implement interactive answers through API I use JavaScript requests running in a user's browser. I want to control access to API and give it only to authorized web-apps, for example, my own client JS-code.</p>
  
  <p>I read about HMAC and Oauth. The key point: the server and the client share the same secret which is used to generate a HMAC, for example. </p>
  
  <p>But how should I generate a HMAC inside a user's browser using a secret and not exposing the secret to others? As I understand, if my JS-code has access to a secret, than anybody on the internet has that access, right?</p>