You whitelist domains that can access your server (in my case I have env vars with whitelisted domains list that the Go code picks up) and that should be all yo

You whitelist domains that can access your server (in my case I have env vars with whitelisted domains list that the Go code picks up) and that should be all you need to do.