In the process of developing a webservice that offers Javascript widgets and Ajax calls limited to specific domains, I have explored various options. However, my research has led me to consider using a combination of HTTP-Referer and API Keys for access control. But, I am concerned about the vulnerability of this approach as tools like RefControl can easily bypass it. Are there more robust and secure solutions available for addressing this issue?