I'm trying to develop a widget for deployment on Sharepoint Online.
The issue is that I need to retrieve personal information for the user from my REST API - however to do so I need to sign the request with my API key.
How should I do this using Sharepoint without exposing the API key on the client side, i.e. in the user's browser? What is the architecture I should be using? How can I create a hosted(?) server side sharepoint app which talks to the REST API?
The following diagram hopefully explains the current approach which has the security flaw.
Thanks for your help.