How can I set API url such that the API is accessible only to IP whitelisted clients while the web application itself remains accessible to all?

Question

I have a web application accessible to the public on a url, say foobar.io Now I want to provide a REST API to some clients to access the data on my server through a protected ur