将javascript小部件限制到某些域

I need to create a webservice providing javascript widgets and ajax calls, which only run on certain domains. After doing a lot of research, I only came up with a combination of HTTP-Referer and API Keys, which is pretty easy to break with tools like I need to create a webservice providing javascr