authentication for relays is coming soon but the way people do it now is only allow events from specific pubkeys, and you could also limit the access by ip or something so other people can't access it to make requests.