As I have said in a previous question, using middleware and prisma requires me to use an api endpoint to fetch data from the database. I made my api endpoint but i cant figure out how to check if it was the server who made the request.

This is sending the auth token for another api so this needs to be secure so any tips are appreciated:

import { db } from "@/lib/db"
import { NextApiRequest } from "next/types"
import { z } from "zod"

const routeContextSchema = z.object({
  params: z.object({
    userId: z.string(),
  }),
})

export async function GET(
  request: NextApiRequest,
  context: z.infer<typeof routeContextSchema>
) {
  try {
    const { params } = routeContextSchema.parse(context)

    // get the user's auth key from the accounts database
    const userId = params.userId
    const account = await db.account.findFirst({
      where: {
        userId,
      },
    })

    if (!account) {
      return new Response("Unauthorized", { status: 401 })
    }

    return new Response(account.access_token, { status: 200 })
  } catch (error) {
    return new Response("An error occurred.", { status: 500 })
  }
}

previous question i was referencing: https://nextjs-forum.com/post/1127306137973305438