Protected by the internal API token (same INTERNAL_API_TOKEN the API uses). Serve this behind your VPN / trusted network only.
INTERNAL_API_TOKEN