We can't advise you on general programming techniques, but we can clarify aspects of how our system works.
Yes, since we would be hitting the URL of your keygen script via HTTP, that means if someone already knew the exact URL of your keygen script somehow, then browsing to that URL directly would display a generated code unless you take precautions to prevent that.
You may want to program your keygen to require some of the parameters we POST to its URL, as documented on the help page I linked previously -- in particular, note the 'handshake' parameter, which you may find useful to validate when our server is contacting yours.
Assuming you're hosted on a Linux-based server running the typical Apache web server software, you may want to place the keygen in its own subdirectory, then in that same folder place the following directives in a plaintext file named ".htaccess", which tells Apache to only allow connections from e-junkie.com:
<limit GET>
satisfy any
order allow,deny
Allow from e-junkie.com
</limit>
<limit POST>
satisfy any
order allow,deny
Allow from e-junkie.com
</limit>