title: How to protect API (from unexpected calls) with IdentityServer4?
body: <p>I have a 3 tiers Blazor application, and use IdentyServer 4.1 for authentication.</p>
  <p>My current problem is that some API endpoints are not protected, any application can do such call.</p>
  <p>My understanding is that IdentityServer only server token for authenticated users, right?
  Is there a way to ensure that the calls are coming from my applications (web site, mobile, etc...),
  maybe with a token... but how?</p>