So I am setting up an AJAX call in Wordpress on the front-end and I came across the wp_create_nonce('wp_rest'). I read some stuff about it but I can't manage to understand the use of it since I can simply not use it and it still works perfectly fine. Can anyone explain me how it works and maybe tell me if I am doing something wrong? Also in the end I'd like to have my custom REST route to only be accessable by my system and not by calling the REST URL manually and also by guests and logged in users. But afaik that's what the Nonces are for?

My PHP Code:

add_action('wp_enqueue_scripts', 'enqueue_scripts');
function enqueue_scripts(){
    wp_enqueue_script( 'ajax-script', plugins_url( 'custom.js', __FILE__ ), array('jquery'), false, true );
    
    // in JavaScript, object properties are accessed as ajax_object.ajax_url
    wp_localize_script( 'ajax-script', 'ajax_object', array( 
        'restURL'  => rest_url(),
        'restNonce' => wp_create_nonce('wp_rest')
    ));
}

add_action('rest_api_init', function(){
    register_rest_route('wc/v3/', '/updateCartData/', array(
    'methods' => 'GET',
    'callback' => 'restAPI_updateData_callback'
    ));
});

function restAPI_updateData_callback(){ 
    $response = array();
    
    array_push($response, $_GET['test_data']);
    
    echo json_encode($response);
    
    // Genutzt um die Kontrolle zurück an den AJAX Call zu geben (notwendig?)
    // Siehe: https://anhkarppinen.com/die-and-wp-die-wordpress/
    die;
}

My JS/AJAX Code:

function updateData(){
    $.ajax({
        type: 'GET',
        url: ajax_object.restURL + 'wc/v3/updateCartData',
        beforeSend: function(xhr){
            xhr.setRequestHeader('X-WP-Nonce', ajax_object.restNonce);
        },
        data: {
            'test_data': 'test'
        },
        success: function (response) {
            if(response){
                alert(response);
            }
        },
        permission_callback: '__return_true'
    });
}

The JS Method is called like this within the Cart of Woocommerce:

<input id="user" type="number" step="1" min="1" max="5" value="1" title="Benutzeranzahl" size="4" placeholder="1" inputmode="numeric" autocomplete="off" onchange="updateData()">