A client is creating a new API application. The app should only be accessible from other apps that they deploy to Heroku. Also, traffic between the other apps and the API should not transit the public internet.
Which solution should an Architect recommend to meet these requirements?