 <p>You could use xauth, which is a variant of OAuth designed to solve this type of problem. Twitter uses xauth: <a href="http://dev.twitter.com/pages/xauth" rel="nofollow">http://dev.twitter.com/pages/xauth</a></p> <p>Additionally, you could obfuscate your Javascript code, or even write it in C (as a NPAPI plugin).</p>