How to allow requests from only one domain in nginx?

Question

Nginx

Good time of the day.

Such a question, more about protecting the API in general, probably.
The server itself: Nginx -> pm2 -> NodeJS.
The API will only receive POST and GET requests from a few specific domains. IP cannot be guaranteed that they will always have the same ones. How can the API be protected in this case? Enable CORS only for these domains? Or is there something else that needs to be done?

Answer 1

No way. Any set of headers can be faked without even going to the site) HTTP protocol is open and controlled with two fingers

Answer 2

If access is expected only from certain places - any form of authorization will do, the same tokens. If the set of sites is small and does not change very often, you can simply cover up by IP and periodically update their list.