title: is using access-control-allow-origin enough to prevent misuse of an api?
body: <p>I am making an api backend that makes use of another api,for example Twitter. (Please note the actual api isn't twitter but I am using them as an example).</p>
  
  <p>Let's say that Twitter has a limit on the number of calls that can be made to their api and above this limit, it starts to charge my credit card. This is why it is very important to me that no one misuses my api.</p>
  
  <p>I want to prevent people from looking at my frontend code and seeing which endpoint it hits, because if a malicious person were to do this, I would very quickly go over the limit and have to pay $$$. </p>
  
  <p>My frontend code uses a <code>get</code> call to <code>mybackend.com/twitter/api</code></p>
  
  <p>Is it enough to simply add an <code>Access-Control-Allow-Origin</code> header to my backend?</p>
  
  <pre><code>headers['Access-Control-Allow-Origin'] = 'myfrontend.com'
  </code></pre>
  
  <p>The reason I am asking this is because I noticed that typing <code>mybackend.com/twitter/api</code> directly into the browser worked, which is not what I would expect if I had <code>access-control-allow-origin</code> set to a specific website. </p>
  
  <p>Am I doing something wrong? How do I prevent someone from simply writing a script to hit my backend since it is clear that just typing it into the url of my browser works, despite me having an <code>access-control-allow-origin</code> header.</p>