I'm having an issue and I'm pretty sure I'm not the first on that. I'm hoping to have a few great ways, hopefully bulletproof, to avoid any issues, so here it is.
I provide an API that converts HTML to PDF via a POST request. When my customer does the conversion, they provide an API key to authenticate them. So far so good.
My question is simple :
How can I offer the possibility to convert documents directly within the browser without compromising their account through the API key?
My best idea so far is to allow my customer to create multiple API key, and have a statistics about how many conversions were done from that key. Moreover, they could indicate which domain works for that key, restricting the usage to a specific (set of) domain(s).
But I know that this is not bulletproof as any coder can spoof the "host" value on a request, and bypassing this "security".
How can I increase the security while offering the frontend capability?
Thanks for your help!