title: How to create private api that can only be accessed by the front-end?
body: <p>I've been looking over the web for a little while but couldn't grasp the concept of making private API only between front-end and back-end. what I essentially want to do is to have an API that's only accessible through the front-end, not through curl, postman or anything else.</p>
  
  <p>I have the following setup: </p>
  
  <ol>
  <li><p>App is hosted on Heroku, backend is in nodejs</p></li>
  <li><p>I use https connection that I self-generated via let's encrypt tool.</p></li>
  <li><p>I have a public API atm that returns a string 'Hello world'</p></li>
  <li><p>Currently, you can access it either via front-end or by going to www.example.com/api/test but what I would like to do is not allow the user to manually visit the link or use curl or postman to get that but instead only make it accessible through the front-end.</p></li>
  <li><p>The front-end is written in Angular 2 (if it matters at all)</p></li>
  </ol>
  
  <p>Note, that I am not planning to have any user sign in on the website, I simply want to restrict access to the API to outside world so that only my front-end can get it. </p>
  
  <p><strong>UPDATE USE CASE</strong></p>
  
  <p>The use case in the future is simple. I have a basic sign up form which asks for email address and a text description. I then use nodemailer on the backend to send that information to the gmail using POST request from Angular 2. I access the data sent through req.on('data') and req.on('end') and process it. My fear is how do I make sure I am not gonna get spammed through that API and receive 10k emails hence my wish to somehow make the API only accessible through the front-end. </p>