title: Limit access to GCP Cloud Function based on domain rather than IAM
body: <p>I have a function that I want to run via HTTP call in a simple script tag, i.e. <code>&lt;script src=&quot;https://server-location.cloudfunctions.net/function-name /&gt;</code>. I want to make sure that the calls only come from a whitelisted domain, like you can do with cloud storage access requests, for example.</p>
  <p>I've seen a couple of suggestions on SO (<a href="https://stackoverflow.com/questions/44699856/how-to-allow-specific-domain-to-access-cloud-functions">1</a> <a href="https://stackoverflow.com/questions/59825183/restrict-access-to-google-cloud-function">2</a> <a href="https://stackoverflow.com/questions/43570358/restrict-access-to-google-cloud-functions-to-a-given-network">3</a>), but they all suggest either a) IAM credentials in the request headers or b) including some security checks in the function itself. These won't work because a) you can't send headers with a <code>script</code> tag and, even if you could, I'd have to store the credentials in the html which is not secure, and b) security checks in the function will not limit the number of calls made to the function, and that's what I want to do (to prevent a horrendous bill).</p>
  <p>Is there a way to do this?</p>