title: Secure API in javascript
body: <p>I want to give my clients access to my API. 
  To make it convenient for customers to use my service, they just need to paste the javascript code into their html page. </p>
  
  <p>But how do I differentiate access? I read about jwt, api keys, and tokens, but they should all be stored on the client side. This appears wrong.</p>
  
  <p>What can I do in this situation? Customer convenience is very important, so I want to leave the possibility of simply inserting JavaScript code. </p>
  
  <p>Maybe I can somehow track the domain from which the request goes or something like that?</p>
  
  <p>P.S. I am using the Django Rest framework to build the API</p>