How to restrict API access to only authorized domains using Express.js?
The best way to accomplish what you are looking for is to forget domains all-together and optionally allow the whitelisting of IP ranges. With that said, some of the biggest APIs in the world do not even use this security layer (i.e. eBay, Amazon's Marketplace, etc...).
In the interest in addressing the extra paranoia though, you could have your clients set up subnets to launch their autoscaling servers into which would give them a static range of IPs to whitelist. Then only servers inside this IP range would be given permission to access your endpoints.
Here is a question on AWS that explains a tad more about that:https://forums.aws.amazon.com/thread.jspa?threadID=233469