I'm working on a small web service that provides some functionality that can be embedded in a web page with an iframe. As this is a subscription-based service, I'd like to be able to manage who can and cannot access the functionality in question via API keys.
My understanding is that one popular approach is to embed an API key into the resource, e.g.:
<iframe src='http://service.com/API_KEY_GOES_HERE/' height='750' width='640'>
When the server receives a request from client, it does a lookup on the referrer to ensure that the site requesting the resource is allowed to access it.
My question is as follows: can't referres be spoofed and wouldn't this make it trivial to circumvent this system? What am I missing?