Hello,

I have an Apex  REST endpoint on our Community which I would like to secure in a way that our company website can use it but it won't be accessible  directly by external users.  I've granted access to the endpoint for the communities guest user account and the function on our website is accessible without having to login, unsubscribe feature, so there won't be an end user access token to use.

Do I need to use a custom coded method in my endpoint to inspect a secret value to control access from the Website or does Salesforce provide a better way to handle access when there is no end user access token? I also considered creating a separate user account that only the Website would use to get an access token to access the endpoint, so no longer anonymous, however this would require the website to maintain the token all day.

Thank You,

Brian