Autenticate API call

[Elia_]

Hi, if I make an API call from the frontend of my site (e.g., from a theme app extension) to my Remix backend, how can I securely authenticate the API call?
The goal is to prevent this API from being replicated, for example using Postman, so that no one else can access the results.

I have already implemented the Shopify proxy and JWT.
However, if someone inspects the page source and finds the script that makes the API call to obtain the JWT — for example: GET "/apps/PROXY_URL/api/get-token" — they can easily replicate it in Postman with the correct headers and obtain the JWT.