How to setup security for calls made from store front to my rest-api

[anilkumar8412]

i am developing a public app for shopify merchants as soon as app is installed on the store it going to add a script tag to the store. our complete functionality is achieved by JavaScript rendered on store front by that script tag. JavaScript add an iframe on store front with src="https://my web controller" which return html .my question is how to setup security mechanism to communicate from store front to my backend rest-services for few actions taken by merchants customer on store front. like if a customer click for point redemption from store front the call goes to our server (how to secure this call)  any kind of help appreciated