In Joomla Joomla 4/5:
What is the best strategy to allow access to Joomla API endpoints from only one (or more) specific domains? And how is this configured in Joomla 4/5? (CORS vs. HTTP-Header-Plugin vs. other solution).
I simply cannot find a best practice by checking the documentation on this topic.