Give people keys on a per-domain basis.
Make people include in the requests the hash the value of the [key string + request parameters]. (The hash value should be computed on the server)
When they send you the request, you, knowing the parameters and the key, can verify the validity.