How does Facebook know it is the real app when calling the Graph API using Javascript?

When calling the new Facebook Graph API, if we just provide the app_id in the Javascript code, then how can Facebook know it is the real app calling开发者_StackOverflow社区? What if it is another app calling with that app_id?

You set your site domain in app properties, if you try to call api from other domains it wouldn't work.