title: How do I set up an API web key with URL authentication in Javascript and PHP?
body: <p>So I've read until my eyes are bleeding so here is my question...</p>
  
  <p>My backend is PHP</p>
  
  <p>I have a service that I want to put out online lets call it GREATSERVICE.com. I want to have people sign up for an API key and restrict it by domain so that only <a href="http://www.????.com">http://www.????.com</a> can use it. 
  I know I can just store the API and domain that the person enters into the database. </p>
  
  <p>I'm hung up on how to validate that the service is being accessed by the proper website. </p>
  
  <p>I mean lets say I'm cruising the web with the domain address temp-13-43.xfinity.com and I go to website servicehost.com. servicehost.com has an API key....as how do I recognize the service is being accessed from servicehost.com and not the clients temp-13-43.xfinity.com address...</p>
  
  <p>So what I'm trying to figure out is to this in javascript on the client side. Kind of like Google Maps. Maps just loads some javascript onto the page with an API key but the API key checks the URL of the WEBSITE and not the client visiting the website. </p>
  
  <p>That is where I'm lost. How can I check the DOMAIN of the site that the user went to and only if it is correct wiht the correct API then render the service out.</p>
  
  <p>So in the head section I have javascript</p>
  
  <pre><code>So on the SERVICEHOST site I give them the code so that they can use the mygreatservice widget. Think along the lines of the twitter embeded viewer
  
  &lt;SCRIPT type="text/javascript" src="http://mygreatservice.com/service.php?api=asdfasdfasdfa&gt;&lt;/SCRIPT
  </code></pre>
  
  <p>tags which point to a PHP page to return the need javascript. Again I just want to make sure that the widget I'm returning is used on the proper sites for light security/tracking purposes.</p>
  
  <p>Thanks</p>