Access control

Help admin who have ability to control the widget

Api token
Allow access from specific website
Content Security Policy (https://developers.google.com/web/fundamentals/security/csp/). By default it will allow all.