Is there a way to protect my POST routes in my express.js app?

Is there any way possible that someone may know of to protect POST routes? I want to use fetch in my client side code, and make it so that the only code who can access my server post routes is my client code.

Currently, I am using CORS Middleware and also using the Host, Origin, and Referer headers, although they can be changed.