I am sending a live RTMP stream from OBS to Wowza Streaming Engine and playing it back in JW Player on my website. Members of my website will be able to stream to their own "channels".
The only issue is that if a viewer on my website views the source, he/she can access the stream key. If a user gets another users stream key, then they would be able to stream to their channel.
What is a good way to protect this stream key?
You can write a module that does a server issued token based authentication. There also exist a free limited version of some commercial modules for similar purpose. Here is an article that shows how to start the work: https://streamtoolbox.com/hello-wowza-module-tutorial