How to restrict API's to run only in the browser?

I am using node js and i put polices to restrict the api's accurance otherthan in browser.For that i put the following condition

app.route('/students').all(policy.checkHeader).get(courses.list)

exports.checkHeader =  function(req, res, next) {
    var headers = req.headers;
       if ( headers['upgrade-insecure-requests'] || headers['postman-token']) {
        res.status(401).json('Page not found');
    } else {
        return next();
    }

}

I am not sure whether my process is correct.I am searching for the common parameter(header-parameter) that exists only for the browser.Can anyone please help me.Thanks.

via MMR