I created another post to ask how to load data extension in Custom Activity UI. Now another question: how can I secure the endpoint page, so I know it is from that Marketing Cloud Journey Builder Business Unit instance?
for example, if my UI endpoint is https://www.mysite.com/endpoint/, I can see it is embedded as iframe in Journey Builder, but there is no parameter passed to endpoint, how can I secure it so it only loads if it is used for that Marketing Cloud instance? Is there any SSO or access token passed to Endpoint applicaiton? This is only for Custom Activity UI, NOT the data workflow after journey is activated.