We are building a system which will have website hosted in cloud/with some web hosting company and it will talk to web apis hosted behind a firewall on-premises servers and the apis will communicate with some legacy systems.
We need to restrict access to this web api to only the external website and want to authorize all api calls. What is the best way to do this?