There are two APIs (A and B) hosted on the same network. A is open to the internet but B is not. Requests to A are currently secured by JWT which users get after logging in. B needs to fetch data from a GraphQL endpoint in A. Due to limitations in A's implementation, it is not feasible to make B act like a "user". What are my options to ensure that A cannot be accessed by unwanted clients?
Right now I'm thinking of simply sending a password with each request which A will check if correct. But I feel like this is not secure.
Another option might be OAuth but that seems excessive for this.
What are my options?
Edit: One more thing to add, both APIs are already using HTTPS.
