An App Service-hosted API requires supported sign-in integration and appropriate application authorization. Which approach fits?

1. Assume hiding the API URL protects it
2. Configure App Service authentication appropriately and enforce required application access rules
3. Treat a valid TLS connection as proof of user permission
4. Grant every caller subscription Owner