We secure Web Services on several layers. Developers have sender credentials to make web services calls and an API call to a company requires user credentials for that company. The company controls the permissions related to the user credentials and also must whitelist the source domain from which the API calls are made. All requests are logged and monitored for anomalies.