Secure my API connection with other websites

Why couldn't the code you send them be modified? All of these measures to try to restrict items that are easily circumvented. I did a quick search and first result is this: http://stackoverflow.com/questions/61710...-by-domain. I'm only trying to point out that regardless of what you do, there is a way around it. Work smarter, not harder.

Moving forward, I mentioned which function you need to override. Add your additional logic there (checking for the domain) and your controller will extend this new class. If that column is in the same table as the API key and the domain and key are a one to one relationship, I would modify the code currently found on line 1028 to include the additional WHERE clause.