How to secure own backend API which serves only my frontend?
Look into CORS. And make sure your server only allows access to specific origins.

On the backend - check if the X-Requested-With header is present in the request and set to XMLHttpRequest. Without a proper CORS handshake this header will be absent.


That being said, this will only protect your API from being used by other front-end apps or from being accessed directly from a browser address bar - because browsers respect CORS. People can still forge requests programmatically/CLI and set headers to whatever they want.
So this is not actually "securing" just a way to prevent abuse & hotlinking
I'm setting up a webapp with a frontend and a backend that communicates with the frontend soley through RESTful methods. How do I make sure that the backend endpoints are only accessed by my own frontend, and not anyone else? I cannot find much information on this.