Hi there @yigiteren,

I believe that one way to do so is to add an additional middleware and only allow requests from your specific IP.

You could use something like this:

function restrictAccess(req, res, next) {
      if (req.headers['origin'] !== 'https://example.com') {
        res.sendStatus(403);
      } else {
        next();
      }
    }

However, this could be manipulated as people could add additional headers to their requests if they wanted to, so a better approach would be to use a JWT token for authentication. To do that you could take a look at these two tutorials here:

https://www.digitalocean.com/community/tutorials/api-authentication-with-json-web-tokensjwt-and-passport

https://www.digitalocean.com/community/tutorials/nodejs-jwt-expressjs

Hope that this helps.
Regards,
Bobby