title: How to restrict access to Chatting service only to registered websites
body: <p>I am making a chatting service (<a href="https://www.zendesk.com/service/messaging/live-chat-widget" rel="nofollow noreferrer">something like Zendesk</a>) and a website must be registered in order to use the service. There will be a <em>frame</em> which the website owner places in the .html file and the rest is up to me.</p>
  <strong>Problem</strong>
  <p>Anyone can start using the service right now (by reading the requests and copying them in Postman). I want a method to restrict access only to those websites that have registered to use the service when the session is started or by the messages sent from that session.</p>
  <strong>Failed solutions (to give an idea of what I am trying to do)</strong>
  <ul>
  <li>A stupid idea was to read and send the website URL with <em>JavaScript</em> and check if it exists in the database, but that can easily be forged.</li>
  <li>I also tried generating unique <em>tokens</em> for each registered website, but the token is something that must be send with the request for validation and since it is something that public can see (the token is placed with the <em>frame</em>) that token is indeed meaningless. (Maybe I don't understand how <em>tokens</em> work)</li>
  </ul>
  <p>At this point, seems like this is inevitable, any Ideas?</p>
  <p>(Back-end is written in <strong>Django 3.1</strong> and My database tables look like this, if it helps - Ignore the details, just an overview)
  <a href="https://i.stack.imgur.com/OzZOa.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/OzZOa.png" alt="Database design" /></a></p>