An endpoint's builder header has a Settings panel with several protections, every one of them off by default, so an endpoint you built before they existed keeps working exactly as it did.
Rate limit
Caps how many requests per minute a single caller can make, counted by their IP address or by the API key they sent. Once the cap is hit, further requests get a 429 until the next one-minute window starts.
CORS
Controls which website origins are allowed to call your endpoint directly from a browser: a specific allowed-origins list, or everyone. This drives the real response headers a browser checks, including on its automatic preflight request, replacing the old fixed "allow everyone" behavior.
Authentication beyond an API key
On top of Requires an API key, an endpoint can instead (or additionally) require HMAC (a signed request header, matching how Stripe, GitHub, and Shopify sign their webhooks, a one-click preset fills in the right header name and algorithm for each), Basic auth (a username and password), or a JWT bearer token, plus an IP allowlist that applies no matter which mode you use.
Request limits and deprecation
You can also cap the maximum request body size, restrict which content types are accepted, and mark an endpoint as deprecated (optionally with a sunset date), which adds the matching headers without taking the endpoint offline.
Tip: A webhook preset is the fastest way to receive Stripe, GitHub, or Shopify events safely, it fills in the exact HMAC header and algorithm that provider actually uses, so you don't have to look it up yourself.