Hi. Let's say I'm building a web app where as a user completes tasks, his level increases. Right now my approach to this is to create an API endpoint in /pages/api that allows me to send a patch request and update his level in my database by incrementing it by one. Then, in the client component where he completes tasks, when the tasks are done I call a function in the client component that sends the patch request to my API endpoint. However, to my knowledge, anyone can use something like Postman and generate the same patch request to my api endpoint, allowing anyone to increment their level to whatever they want.

I could be wrong, but I don't think adding authorization to my api routes is the solution here, because any logged in users can still access the api endpoint and increment their level, but I want it to only increment level when my code determines it should.

In order to fix this, I could use server components and call the backend code from a server component. However, I don't necessarily want to do this and I'm wondering how people would have solved this problem in Next 13 pages router. What is the recommended approach here? Am I just thinking about API routes completely wrong?