protect endpoints when using fetch()

Mitch

Is there a way to restrict an endpoint to requests to particular domains?  I see the precondition function can call the $http_headers object, but there is no "contains" operator option, for example.

Or is there another way to protect an endpoint so that someone who looked at my code couldn't just call the endpoint
  
Thanks!

Lukasz Kwiatkowski

user token authorization is one of the method but i would be curious to learn more about other ways