>"lock down my API so it's only callable from the web front end I provide" Generate secret tokens that the server can validate using some heavily obfuscated pr

>"lock down my API so it's only callable from the web front end I provide" Generate secret tokens that the server can validate using some heavily obfuscated process. Compile the JS to WASM. If you can use HTTP3 or WebSockets that's a bonus, because you can create a custom protocol that does some secret handshake before sending the goods.