How to ensure Upstream API endpoint only invoked through KONG

[Cooper]

While certainly not the whole answers, these threads may provide some ideas:

How best to secure api from requests that aren't routed through Kong

Hi, my organisation is planning to use Kong to secure an API. We are considering approached for securing the API in situations where the requests are sent to the API without going through Kong (e.g. if the API is accessed by IP). Is there some way to tell if a request has come via Kong, that can be used by the web server to allow traffic through? I understand I can check the IP address, but maybe there’s some way to get a signed token, in case I don’t know the IP?

Force user's to request API data via Kong

Hi, I deployed Kong with the OAUTH2 Plugin successfully in front of one of my API’s. The thing is, I can still directly do requests against my API endpoint without going through the api-gateway which should not be the case, as all requests should be routed via Kong. How can I tell the API that a direct request is not a valid one - that the requests has to be sent to Kong? Best, Max