I'm currently signing users (authenticating) from the frontend, and making requests to the backend to sign up the user(save data in the database). I realize i cannot completely prevent this, but i don't want my API(signup) to be abused.

Go:

func SignIn(w http.ResponseWriter, r *http.Request) {
    params := mux.Vars(r)
    u_ip := base64Decode((params["u_ip"]))
    u_wallet := base64Decode(string(params["u_wallet"]))
    u_password := base64Decode(params["u_pass"])

    u_addr := strings.TrimPrefix(u_wallet, "0x")
    u_addr_temp := u_addr[0:7]
    for rowExists("select 1 from users where position(user_addr in $1)>0", u_addr_temp) {
        randInt := rand.Intn(5)
        u_addr_temp = u_addr[randInt : randInt+7]
    }

    sqlStatement := `INSERT INTO users (ip, user_addr, user_wallet, user_pass)
     VALUES($1, $2, $3, $4) returning id;`
    id := 0
    db := opendb()
    err := db.QueryRow(sqlStatement, u_ip, u_addr_temp, u_wallet, u_password).Scan(&id)
    if err != nil {
        panic(err)
    }
    w.WriteHeader(http.StatusCreated)
    w.Header().Set("Content-Type", "application/json")
    resp := make(map[string]string)
    resp["message"] = string(id) + "-" + string(u_addr_temp)
    jsonResp, err := json.Marshal(resp)
    if err != nil {
        log.Fatalf("Json Err. Err: %s", err)
    }
    w.Write(jsonResp)
}

Javascript:

              const u_wallet = window.btoa(result);
              const u_password = window.btoa(password.toString());
              await fetch(
                `http://localhost:8080/sign/${u_wallet}&${u_password}`,
                {
                  method: "POST",
                }
              )
                .then((response) => response.json())
                .then((data) => console.log(data));
            })();

You can see users can call http://localhost:8080/sign/${u_wallet}&${u_password} replace the wallet, and password (Base64 encoded) And GoLang will automatically create the row(in the database).

Go CORS:

    c := cors.New(cors.Options{
        AllowedOrigins:   []string{"*"},
        AllowCredentials: true,
    })
    handler := c.Handler(router)

I can define Allowed Origins as strict-origin-when-cross-origin, but users will use the devtools console(JS). My question isn't sending the data(safely), but how to communicate from the frontend and backend, and try and block users from calling the API.