I'm currently working on a Next.js application where I've set up some API routes. These routes fetch data from a paid third-party API such as currency exchange rates or translation. Although this data should be publicly accessible to visitors of my website, I want to prevent these routes from being abused by other applications or through direct access via tools like Postman.

What are some strategies or practices that I could use to protect these routes? For example, is there a reliable way to check if a request is coming from my own website or to encapsulate the third-party API request inside server-side code?

Any advice would be greatly appreciated. Thanks in advance for your help!