Asp.Net MVC4 stopping people requesting or posting data to my API

[JuttyMire]

I want to be able to use AJAX to Get/Post to an API controller in my MVC4 application.However, I don't want anyone to be able to setup a web page and get/post to the controller - only from web pages delivered from my server.So, should I just use a normal controller and return data, rather than an API controller? (or have I misunderstood that using the API controller opens up the web application to any Get/Post?)Thanks, Mark