Then I wouldn’t worry about any of that. You could put an htaccess file in front of the api so you have to enter a known in / pw - but that’s handled by the bro

Then I wouldn’t worry about any of that. You could put an htaccess file in front of the api so you have to enter a known in / pw - but that’s handled by the browser. Just do the absolute simplest thing you can do until you have more complicated requirements. Edit see other comment (don’t want the thread to get unreadably deep!)