title: Distributing Webpage Widgets that need to Access an Authorized API
body: <p>I have developed an API that uses JWT to authorize client requests. Seasoned developers can get a JWT using a login API over HTTPS and use that JWT to make subsequent authorized API calls. That all works fine.</p>
  
  <p>Now I've got some interest from less-seasoned developers who are primarily front-end oriented (HTML/CSS/Javascript developers). Ideally for this class of individual, they'd like to be instructed to "drop this script tag in your HTML, set it up like this, and magic will ensue." </p>
  
  <p>Without having them also deploy some kind of proxy server on some random port (e.g. like 9090) on their back-end (which is the where my brain went when I thought about this independently), is there a canonical strategy that would allow this sort of thing without that developer having to put their JWT in their client side code, and therefore break the authorization / authentication model of the API (since in that case anyone could masquerade as that user by, e.g., simply looking at Chrome developer tools network and/or source tabs).</p>
  
  <p>Obviously my back-end proxy concept is not perfect, and could be abused, but at least I could revoke a maliciously behaving JWT under some kind of abuse scenario and communicate to the affected authorized developer to come up with a resolution. Setting up a proxy service is a lot of effort for some people though. I guess I could ultimately set one up for each developer who wants this sort of thing if they were willing to pay for it, but I am left wondering "is there a better way?". What say you?</p>