One simple solution could be to just use API keys for each of your backend services, and to add a middleware for all routes which checks that the API key is present in the header.