How can I prove the identity of a logged-in user in a Nationbuilder theme to a 3rd party API that I control? As officially answered in https://nationbuilder.com/xdjc/making_nationbuilder_api_requests_inside_of_a_nationbuilder_theme, there's no way to get an API token or other token from Nationbuilder inside of javascript that can prove the identity of the logged in user to third party APIs. However, that answer also says the correct way to make Nationbuilder API calls from a theme is to set up a 3rd party API and call it from the template. So, how can I prove to the API that the request coming in is in fact coming from a logged-in user in nationbuilder and isn't being faked? And how can it verify the user ID is in fact who the user request says it is? Another way would be to use a HMAC with a secret key inside of liquid, but as officially answered in https://nationbuilder.com/xdjc/when_will_nationbuilder_liquid_support_the_hmac_sha256_filter, there are no hmac filters in nationbuilder either. So what's the recommended solution? Or do I just need to not have any authentication on the API, and just pray that the requests are really coming from a logged-in user on Nationbuilder and not a malicious actor?