I have to design a "widget", a script that partners will embed in their websites to display some UI and make calls to our API.
Basically it will display our data on these sites based on some IDs they provide in our API calls. What we would like to avoid is someone abusing the API and using it to scrape the entirety of our catalog.
Each partner that embeds our script will be given a public key that must be provided when calling the API. An idea would be to ask them to append this key when loading the script, e.g.:
<script src="//initrode.com/widget/loader.js?key=xxxx"></script>
That way the request for the script can be used to register the key/source IP pair, and answer subsequent API calls only if the key/IP pair matches a registered one (with a limited lifetime, and a limit on requests per day).
I'm not sure it's a good idea since it's obviously security through obfuscation (someone reloading the script will completely bypass it) ; but I don't see any other way to restrict access. I cannot provide a unique key to every user, only to partners. I can't use a private-key system since all the code will be available to anyone. It's basically restricting access to a public API, i.e. contradictory in its definition.
What do you think of this solution, and what would you do with these constraints?