title: How to "Secure" AJAX calls?
body: <p>I'm sure this question has been asked before, but I can't find a thread that explains it in a way that makes sense to me.</p>
  
  <p>I'm creating a bookmarklet/browser plugin written in Javascript.  This script makes calls to an api, effectively sending a users activity information from one site to another. (think, making a tweet when a user posts a facebook status)</p>
  
  <p>This site loads javascript right into the site.  The API I'm using requires an MD5 hash to be generated using an API secret code.  This is no problem, I'm making an ajax call to a PHP script I'm hosting elsewhere, that returns the correct string.</p>
  
  <p>Problem is I don't want the user to be able to make a call to this same script to generate their own strings, with the secret embedded to abuse the API.  Is their a way I can only allow calls to this API when I want to make them?</p>
  
  <p>Or maybe I'm approaching this from the wrong direction.</p>