title: How can I hide API secret key when sending AJAX requests?
body: <p>I am about to start working on a project, which is basically a web interface for a mobile banking application. The API is ready, I only need to provide the frontend part of the web application. I was going to make it using Backbone/Angular/Ember, but started to worry about the security.</p>
  
  <p>Particularly, the following. As a rule, every API request must contain a parameter <code>method_code</code>, which is calculated as hash of user token, method name and secret API key. If I put the logic of how this param is calculated into one of .js files, anyone could potentially access some sensitive data using tools like Postman or even browser console. How should I go about this issue? I could have a server-side script generating the <code>method_code</code> for me, but is it possible to make it accessible only to my web app's requests?</p>