Как закрыть доступ к API и пускать только из приложения?

var request = require("request");

var options = { method: 'GET',
  url: 'http://127.0.0.160:8091/categories.get',
  qs: { lvl: '0', offset: '0', count: '100' },
  headers: 
   {
     'Authorization': 'Bearer eyJhbGciOiJIUzUxMiJ9.eyJpYXQiOjE1NzMyMTE3NzAsIm5iZiI6MTU3MzIxMTc3MCwiZXhwIjoxNTczMjE1MzcwLCJ1c2VyX2VtYWlsIjoiYWRtaW5AbWFpbC5jb20ifQ.0-VX8Pbv9l-ELXOoPV_6DTP1166X5DUvHZobXHh5xed2FRbNbbGMFrrai7khnApfywQeZjzasrqVwmcgrDq4kg',
     'cache-control': 'no-cache' 
   } };

request(options, function (error, response, body) {
  if (error) throw new Error(error);

  console.log(body);
});

import {ACCESS_TOKEN} from "../store/mutation-types"


export default async function ({store, redirect, $axios}) {
  
  const token = store.getters[ACCESS_TOKEN]
  console.log(token)
  if (!token) {
    return redirect("/login")
  }
  
  await $axios.$post(`${process.env.api}/security.checkAccessToken`, {token})
    .then(({code}) => {
      if (code === 0) {
        console.info("Token verified!")
        return redirect()
      }
      console.info("Token not verified!")
      return redirect("/login")
    }).catch((e) => {
      console.info(e)
      return redirect("/login")
    })
}