How to restrict backend to only serve requests from my Netlify site

[hrishikesh]

Yes seems like that should do. You can try visiting your function by directly calling the URL, or by sending an invalid auth token on purpose to see if it’s properly showing the error. As long as it’s doing that, I think you’re fine.