How to allow API route to be opened only from the specified domain?

Question

API

I have a route https://my-api-server/datathat my application uses https://example.comto receive data.
On this API server, I set it Access-Control-Allow-Originwith a value https://example.comand now this route is "embedded" only by this domain (origin). But the problem is, if I go directly to the address https://my-api-server/data, then all the data is open.
How to make this CORS work also on a direct transition along the route and work only if the request comes from the specified domains?