Is it possible to restrict a static site to allow only access from cloud run (iframe embed)?

Question

I have a React app running on google cloud run, with user authentications and permissions.

Now I would like to write documents for the app. The documents will be a st