Get Origin when the request is made internally and not by the browser

I am making a request from one web API to another. I want only the first API to be able to request the second API, others are not allowed to do so.

I have applied CORS, but since the request came from an API, there is no origin in the request. Is there a way that my second API can only access the first one.

NOTE. I am using WEB API 2.