Grant access to Joomla API from just one site

Question

In Joomla Joomla 4/5:

What is the best strategy to allow access to Joomla API endpoints from only one (or more) specific domains? And how is this configured in Joomla 4/5? (CORS vs. HTTP-Header-Plugin vs. other solution).

I simply cannot find a best practice by checking the documentation on this topic.

Answer 1

Great question. Maybe .htaccess can do this?

Require ip 192.0.2.0

I would put this in a .htaccess in the /api folder as a test.