Lock Down a Strapi API with Roles and API Tokens

1. Go to Settings → API Tokens → Create new API Token.
2. Choose Custom, and tick only find and findOne on the types you need.
3. Send it from your server, never the browser:

curl -H "Authorization: Bearer $STRAPI_TOKEN" http://localhost:1337/api/recipes