WordPress already has a sense of public and private pages. The former is what"s used to display the majority of sites which run WordPress. The latter is shown only to those individuals that have user accounts for the site, are logged in, and have the capability to read private content.
But, what happens if you want to share private content with site members, but do not wish to create a user account for each of them on the site? Enter the WordPress REST API and this plugin.
This plugin creates a custom visibility for Pages, called Protected, and removes the password protected option for them (to avoid confusion between two uses of the term "protected"). Then, any Page marked protected becomes only available via the API and, even then, only available from specific authorized sites.