OK so server-side security is not my forte. Basically, I'm building a service which users may use (via an SDK) only on the domain they stipulated when they signed up.

The SDK calls my web service over cURL in PHP.

Would I be right in thinking I cannot reliably detect the caller domain, i.e. enforce that it is the same domain they stipulated when signing up?

cURL of course sends this over headers, but headers can always (?) be faked.

Is there a better course of action to enforce domain for this sort of thing?

(NB I'm already using an API key, too - it's just I wanted to restrict domain, too)

Thanks in advance