title: How to accomplish a secure authentication in Javascript API
body: <p>We are trying to develop an API for our service and we are doubting in how to accomplish the authentication process. Our clients have to be able to include a .js file which connects with our Node.js server. The key point here is that our backend must track the use of the API so our clients are going to be charged according to its use.</p>
  
  <p>Our intention is to design the API as simple as possible for the users, as well as making it secure. We have thought of:</p>
  
  <ul>
  <li><p>Creating an API_KEY for each user and matching it with their domains in every request. Problem here could be that the domain is not the most secure option, isn't it? We understand that the domain may be supplanted in an HTTP request.</p></li>
  <li><p>Using a SDK with an API_KEY and SECRET_KEY to generate a token for a given session and user. I don't dislike at all this option but we would prefer a simpler solution for the developers, which would not imply using several APIs.</p></li>
  </ul>
  
  <p>Do you have any ideas/suggestion/considerations/whatever?</p>
  
  <p>Thanks in advance.</p>