I created one webapi application which includes few modules like account, user etc and overall includes 10 or more endpoints.
I deployed this in EC2 instances and configured in application load balancer with domain in cloud front. The authentication used is oauth2 (bearer token)
All working fine and can access using domain address and load balancer address. As this can access from anywhere and can register to the application using register API. So how can I restrict this.
How can I restrict this public access? Which is the standard practice for this deployment?