How to create an API key that is tied to a domain?
===

Question
------
How do I build an API that makes sure a request is coming from an allowed domain?


Details
------
I am building a REST API. I need a way to distribute API Keys but only allow them to work from the domain they are registered with.

The main issue is my API Key needs to be embedded in a Flash File which can easily be decompiled to steal the API Key. The other scenario is I need the key embedded in javascript which can also be easily read.

Good news is I know which domains to trust. Bad news, I don't know how to actually securely check if its actually coming from a trusted domain... without spoofing. 

I have heard a lot of people say use `$_SERVER['HTTP_REFERER']`. But that is easily spoofed.

 * How do I build an API that makes sure a request is coming from an allowed domain?
 * How do I create an API key that is tied to a domain?

Related Stackoverflow Questions:
----
These questions are related but didn't quite answer my question. Figured I would just put them here for future reference. 

 * http://stackoverflow.com/questions/2113215/google-api-key-and-domain-check
 * http://stackoverflow.com/questions/2256305/how-does-google-maps-secure-their-api-key-how-to-make-something-similar