I use nginx with simple auth rules such as the following:
location /api { #... deny 192.168.1.2; allow 10.128.99.1; allow 127.0.0.1; deny