I am quite new to creating services using PHP-cURL. I want to offer some data/service to only registered domains. I know that I can identify these domains using app ID and API keys for data encryption.  

However, I was thinking about different types of threats. What if some of my customers give their credentials to another domain? How can I validate caller domain (or any other solution) so that the credentials will be used only by that domain? I really tried to detect exact domain name that is calling my service, but I fail every time, because anyone can set a fake domain name in the header. I was thinking about using IP, but that would be a really complex solution.   

Also, I don't want to limit calls. I just want to be sure about which domain I am giving data.

They use alternative methods from traditional credit card/wire transactions, namely prepaid cards and crypto-currency like bitcoin. This is because it's much easier to stay hidden this way. 

This article outlines more information if you're interested: TeslaCrypt: Following the Money Trail and Learning the Human Costs of Ransomware  
