title: Constrain clients to ones coming from the own app/website for unauthenticated web API
body: <p>These are the criteria:</p>
  
  <ul>
  <li>My users are unauthenticated.</li>
  <li>My app is a single page web app (written in JavaScript) that uses RESTful web API endpoints to fetch data from my own server.</li>
  </ul>
  
  <p><strong>Objective</strong>: I'd like to constrain the web API to only allow requests from my own app, without requiring users to authenticate. Are there existing techniques for this?</p>
  
  <p>The issue is that since the web app's code and the requests made by it are transparent to the client it can't hold a secret for authenticating with the server.</p>
  
  <p>I thought about creating single-use access tokens on the server side, then use those from the client side for the API calls. Now this would make it harder to do requests from the outside, but still you could make requests if you fetch this token from the original website first (even if you'd have to do it for every request).</p>
  
  <p>If it matters I'd implement this with an ASP.NET MVC website and ASP.NET Web API endpoints.</p>
  
  <p>Similar to <a href="https://stackoverflow.com/questions/19653030/only-allow-certain-domain-to-access-web-api">this question</a> but not entirely the same.</p>
  
  <p>Thanks in advance.</p>