In our API implementation of a Azure custom resource provider how do we authenticate that the request is coming from Azure ARM service

Question

We are not finding documentation around how the Azure Custom RP is to authenticate requests are indeed coming from Azure management service and not wide open for anyone to c