title: How to keep API keys secret when using client side Javascript?
body: <p>For example, check out this <a href="http://developers.facebook.com/blog/post/198/" rel="noreferrer">Facebook</a> plugin.</p>
  
  <p>In the client side the API key is clearly visible. What is stopping another user from obtaining this key and using this feature on a different site?</p>
  
  <p>I figured a very naive implementation would be to check the domain the request comes from but things like this are easy to fake.</p>
  
  <p>If I were to create something similar, how would I go about securing the authentication process?</p>
  
  <p>I want as much of this work to be client side, though some form of server authentication will be required surely? Any links or advice would be greatly appreciated.</p>
  
  <p><strong>Update</strong></p>
  
  <p>Similar <a href="https://stackoverflow.com/questions/2256305/how-does-google-maps-secure-their-api-key-how-to-make-something-similar">question</a> about API keys that I found useful.</p>