you can secure you endpoint by checking any identity from the client. For example a token. That can be a Bearer token, an api token, ...

Your server know the token and like that only you and your server can call your api with a valid token

but incase you has a token.
it should also included the curl from the browser network request.

i think we might need a way to limit with the ip.
so we make sure only some servers ips can call. others not
what's your thoughts ?

ips can also be changed and yes of course this token need to be handled securely. So the user who uses this token should not be allowed to share this token. It's his identity. You are not sending the token inside the url. Normally via a cookie or inside a post body. So even if you share the url with others, they also need your token to access the url

if you tried to copy network request as a CURL.
you'll the see the token included

yea, because the client who made (past) the request already knows the secret token. It like sharing a secret with your client so they can access your application. And of course this secret should not be shared

They are just http requests at the end of the day. Http requests can be constructed, cloned, nothing you can do about that.

You can add rate limting

But like joulev said it is impssoble

Yeah rate limiting will help prevent spams if you are worried about that. Recaptcha is also a good idea. That’s about the most protection you can have already.

Yes, and most of the rate limiting is handled via ip like you said. Or (of course) via the token

I see.
thanks you all. this was helpful for me
appreciated

Happy to help. Please mark solution