PHP / ajax apsauga, su kintamu raktu ir laiko žyma

$time = time();
$hash = md5($key . $time);
$url =  "http://domain.com/iframe?hash=$hash&time=$time";

On the other side you should first check if the timestamp is in the limits (e.g. not older than five minutes) and than rehash with the key and the submitted timestamp. If you get the same hash the request is valid.