I'm going to have to dig into it more, as filtering content from an API feed based on the referring domain's api credentials is something that's commonplace in the private sector and on other open source projects - in fact, I've recently built some reports in Quicksight that do exactly that, and output results on a secure row level basis.
I think it appears more daunting than it is (context I've been a web dev, analyst, ecom manager for 20+ years), but I haven't yet had time to dig into the code. As you're now the fourth person to make this claim, I'm now inspired to actually go and dig into this and see if I can hack it on my own. If I manage to do it (or it results in total failure), I'll update my opinions and these posts accordingly. Disclaimer - I am lazy and slow, so this may take a bit.