How to restrict a function to avoid being called externally out of the game?

Question

I'm developing a game on top of Ethereum which combines NFT's and some cool RPG gameplay dynamics. My doubt is that, for as far as I know, every function in the contract can be called from outside from anyone.

That makes me wonder, for instance my game is planned to reward players by giving them NFT's if they do some in-game stuff, like quests or fights. The function I thought it could look like this:

function rewardPlayer(address memory newOwner,string memory tokenURI){
    //Pseudocode
    _mint();
    _setTokenURI(tokenURI);
    transferOwnership(newOwner);
}

Obviously, my biggest concern is that someone could come and call this method giving its own address, awarding himself with rewards.

So, I need a manner to avoid this. I thought of generating a encrypted key which only allows to be executed with it, but, how does Solidity decrypt keys? Is it even possible? Is it any better way?

Thanks in advance :)

Answer 1

Id make the function callable by one wallet only (using onlyOwner for example), and handle the rest of the logic to figure out what the parameters should be on the website directly. The drawback is that you'd have to pay the gas fees yourself.