Within an UI extension app, how can I authenticate/authorize in a serverless function as to not make it callable from anywhere? I only want to allow requests from my UI extension (logged in users)
Reading the docs, it seems serverless functions are public by default? Is there some way to get around that?
Hi, @ajinvise 
Your understanding is correct. I could not find a documented workaround in the docs or in a community post. And I’d like to invite some of our community members who have experience with serverless functions — hey @Teun @himanshurauthan @Kevin-C do you have any experience or insights you can share with @ajinvise?
Thank you for taking a look! — Jaycee
Hi Jaycee!
Thanks for looking into this. I actually got good news via Robert Moon at support. Pasting it below.
-----------
Thanks for reaching out to HubSpot Support! It sounds like you’re looking to clarify how UI extension-related serverless functions can be made to run only when called by your UI extension directly. I can definitely appreciate the need for security when running serverless functions which may handle confidential data; let’s go over the situation and discuss how to handle this challenge.
As documented in our overview article related to this feature, UI extensions consist of two components: the React-based front end which runs within a HubSpot CRM record, and the serverless back end which is called by the front end to run processes and retrieve data for display. Within the context of HubSpot-related development, it’s important to note that there are actually two “flavors” of serverless function: one for use in UI extension projects (as you’re addressing here), and another for use in the CMS environment, where a website page can call a serverless function to populate the contents of the page. CMS serverless functions are by definition public, since they retrieve data for display on public web pages (although they can include secrets which retrieve data from secure systems). By contrast, UI extension serverless functions are always called through a UI extension card by an authenticated user within a given HubSpot account. This contextual information is provided in the contents of a “context” argument which is passed to the serverless function’s main thread. Checking for the presence of, and details provided within, this context argument can serve as authentication to ensure that the function can only be called from within your HubSpot account.
I believe the above should address your concern on this support ticket, but please let me know if you have additional questions or if anything above is unclear. Thanks for helping me help you, and have a great rest of your day!