How would I secure a publicly available API route that only I can use?

What I want to do:I have a local unRaid server which hosts a Windows VM. I also have a digital ocean server with a Express/React app for my public website. I would like to have a route that would SSH into my unRaid server and turn on my Windows VM and return the status. Failed to start, already online, successful, etc.I want to do this so I don’t have navigate through the WebGUI to start my VM and I can instead start it with a Siri shortcut or start it remotely if I want to remote in.What would be the best way to guard this route in Express? Would it be as simple as passing a password in the POST request and rate limiting the API calls to protect against brute force? Or am I missing something here?I eventually will want to implement OAuth for other projects, but then there is the question of could I validate when triggering through an IOT device or a Siri Shortcut?I would prefer to keep this as simple as possible.

Submitted August 21, 2020 at 07:59PM by JamesGiesbrecht