Keep Coding

I have an API endpoint that normally requires an API key header for access. Now I want to use the endpoint in a chrome extension and somehow need to protect access to it. Is there an alternative approach? The API-key won't work since everyone can read the JS files of the extension.
TLDR: How can I make sure only the extension can call the API endpoint.
Here are my thoughts so far:
obfuscation: just makes it a little harder to get the API key
origin header: only allow requests from the extension. However, headers can be easily spoofed with a curl request outside the browser
IP rate limitation: only allow x requests/hour per IP. Can be cicumvented by proxies and might cause issues for users on a public network.
user registration: users register for individual api keys. However, this is not really an option. It would add a huge barrier.