It sounds like you’re using the Realm Web SDK and calling functions this way.
Does that mean that the connection is made from my IP to the app service
Yes it would be the ip of the person visiting the website.
since I cannot list every single person’s IP in IP Access List
The ip access list entry can be a CIDR notation including a range of addresses. Could you target the multiple addresses this way?
Alternatively you can specific an Authorization Express in the function itself which has to evaluate to TRUE before running the function. Please see options for Expression Evaluations for e.g. you could use the %%request expansion to evaluate the referrer with a list specified in a value called “referrers”.
{
"%%request.httpReferrer": { "$in": "%%values.referrers" }
}
Regards