Now I am wondering whether it is a good practice to change the database connection string in the Web API application based on the request origin?
It depends upon what you mean by "based upon the request origin." If you're referring to something that the client controls, such as an IP address, then what you're considering is likely a bad idea. Things controlled by the client are easily spoofed and are effectively an invitation for mischief.
On the other hand, if you're referring to something that isn't easily spoofed, such as a client authentication token, then what you're considering is fine.
I can't tell which architecture you're planning on using.
In either case, the general concept that you're grappling with right now is termed "authorization."
Authentication is a related concept, but refers to the client proving they are who they say they are. Typically authentication is done with passwords, certificates, tokens, etc....
Authorization is related to providing access to functionality based upon who the client authenticated as. Determining database connection strings based upon client authorization is a fairly typical case for authorization.
If you happen to be using Option A, then the Web API will determine DB and application access based upon the client's authorization privileges. And if you happen to be using Option B, then you'll need to make sure that the application passes along the authentication token into the Web API so it can determine the correct DB for access.