I am making a Google Analytics like service where you embed generated code into your website and it tracks certain data. I have a backend REST api, but I am not sure how to securely implement a call to it in the frontend without all the authentication data being exposed. I am worried that if a user embeds this code into their website with authentication, such as a session ID or a user ID, anybody would be able to just take that data and make a call to the api before the session times out and mess with the user's data. Is there any way to prevent this risk and safely design the backend api and the call so that it is much more difficult or impossible for people to make calls to a user's private api?
You can have something like a JWT token, where the user (front-end) will know, but can't read it. Then, for each request you send the JWT token and your back-end will know how to decrypt and validate if the user can perform or not this action.