Integration Development Architecture Question - Validating requests are coming from a HA instance

Development
1

I’m working with a company who is interested in developing an integration for HomeAssistant. They are not however interested in opening up a public API. In other words, they are fine exposing data to HomeAssistant integrations but do not want to open it up to other web requests.

Is it possible to develop an integration that does push or poll over HTTP or websockets that only* responds to requests from HomeAssistant? I’m scratching my head thinking about how I would implement the integration in this way, as requests will be coming from wherever the user is located. Is there some way I can confirm it’s from a HA instance?

Any help appreciated, thank you!

2

Integrations are written in Python. Anyone can view the source. Any method you use to validate a signal to the integration from a specific source would be visible in the code.