I am currently implementing a Facebook Chat Extension which basically is just a web page displayed in a browser provided by the Facebook Messenger app. This web page communicates with a corporate backend over a REST API (implemented with Python/Flask). Communication is done via HTTPS.

*My question:* How to secure the communication the Web page and the backend in the sense that the backend cannot be accessed by any clients that we do not control?

I am new to the topic, and would like to avoid making beginners' mistakes or add too complicated protocols to our tech stack.