I have an endpoint that returns JSON, which I use on a site with AJAX. 

I want to use the same endpoint from other sites (running on different domains), so I want to convert it into JSONP with a callback. 

The data is not sensitive and doesn't need extensive security. However, I want to make it as difficult as possible for other sites to use the endpoint directly in their sites. (I realize that they can technically use almost any internet accessible endpoint through server side code or reverse proxy).

What's the best way to accomplish that? 

One idea I had is to add a [JWT](http://jwt.io/) token as a parameter. The token would be served on sites that use the endpoint. Would that make sense? Is there a better practice to accomplish this?