How to limit access to Azure Function App to a website and clients only

Question

I have an API running on a Function App in Azure.

I want this API to only accept communications from two parties:

1. A blazor website
2. All copies of a piece of packaged software (a WPF application which will run on customer computers)

I want all other traffic to be rejected.

What is the best way to configure this.networking scenario?

The ideal setup:

API should only be able to talk to the Blazor App as well as the client programs, not outside connections. The API can talk to the database which lays behind a virtual.network . This Database .NET is already set up.

Any help is appreciated.

Answer 1

Use API Management in front of the API and require Ocp-Apim-Subscription-Key in the requests.

Also, add ip restrictions to avoid unauthorized access