Is it possible to create a javascript api that only allows certain domains to call it -

i want provide data different websites through javascript api, , don't want others have modify backend code.

i believe best way providing jsonp other websites (please correct me if wrong).

however don't want able use api - options controlling usage of api.

if api called js running on remote website use cors (check ie support).

but if need more granular control on api usage must use key , check referer against key.

btw using key can make script faking referer , using api.

but if it's js api there's no alternative.