title: Securing my API to only work with my front-end
body: <p>I'm building a node/express backend. I want to create an API that only work with my reactjs frontend (private API).</p>
  
  <p>Imagine if this is an e-commerce website, my users will browse products and will then choose what to buy and at the time of order they might or might not login.</p>
  
  <p>What is the best practice to make sure my APIs will only work with my reactjs frontend? </p>
  
  <p>What happens when users decide to login or if they remain as guests?</p>