Also, isn't it normal to check the referrer when using API keys? That's what Facebook does -- API keys only work from certain domains, which effectively restricts their access. The downside is that you need to maintain separate API keys for every domain (staging, sandbox, etc), but the advantage is that they don't rely on the honor system :P
Also, isn't it normal to check the referrer when using API keys? That's what Facebook does -- API keys only work from certain domains, which effectively restricts their access. The downside is that you need to maintain separate API keys for every domain (staging, sandbox, etc), but the advantage is that they don't rely on the honor system :P