Which implementation is the correct one for my case?

[md186]

Hey there, I stumbled over next-auth and the security topics and I feel kind a like lost and cant see the correct solution for my use case.

I have an app where users can create posts. There is no login or user account needed! They submit content with a form as post request. The post request refers to my api endpoint. I also have some other api points with fetching functions.

My goal is to protect the api endpoints completely except some specific sites who are allowed to request the api ( I want to accomplish this by having domain name and a secure string in my database which will be asked for if its valid or not if you call the api). This seems good for me. But I also need to make sure that my own application is still able to call the api endpoints. And there is my big problem. I have no idea how to implement this and I didn't find anything good.

So the api endpoints should only be accessible for:

• Next.js Application itself if somebody does the posting for example
• some other selected domains which are getting credentials which are saved in my database.

Hopefully somebody has an idea.