javascript - Building an HTML Widget to embed paid content - how to secure communication with the backend? -

i'm creating widget shows content when page visitor pays it. i'm handling payment form inside widget , i'm using stripe credit card handling, charges, etc.

my problem is: want make easy user pay content, right now, i'm working proof of concept ask email, then:

• check if have email on system, check api server if has payment product associated , let user content.
• if email not present in system, created, , return stripe publishable key.
• if email present, has no payment associated product, return stripe publishable key.
• when widget gets stripe key, shows payment (credit card) form, used stripe token, , token, along email, sent api server. if ok, widget retrieves content , shows user.

now, question(s): how secure communication between widget , server, besides using https? have support application id/secret pairs, how can use them to authenticate requests widget server? widget inserted in pages on arbitrary domains, using referer/origin headers out of question.

i don't think important, if helps, i'm using django 1.7 , django rest framework 3.0.5.

thanks!

there api can use, called cointent. sub-motto "purchase individual pieces of content small prices 1 account , 1 click." head head head head...