How to stop server action being called directly from browser

You can use a Condition step, and if you want to abort you can use the Response step with an error code like 401 (Unauthorized) or 422 (Unprocessable content)

Or:

1 Like