restrict access to external apps api