It is of course possible, it just needs a domain whitelist, app public api key and per user rate limiting