How to protect apis like apisix/admin/xxxx

[Lang Wang]

For the plugin example:

curl http://127.0.0.1:9080/apisix/admin/routes/1 -X PUT -d '
{
    "methods": ["GET"],
    "uri": "/index.html",
    "upstream": {
        "type": "roundrobin",
        "nodes": {
            "39.97.63.215:80": 1
        }
    }
}'

The api seems like without any authentication. So what is the best practice
to protect those sensitive apis in prod env ?