Ask HN: Is this plan for using API key for security a good idea?

I have an AWS API Gateway that I need to "secure". I'm putting that in quotes because I realize that what I am thinking of doing - api keys - isn't secure in the true infosec sense of the word, i.e., I'm using a usage management tool for security purposes.

My question is this.

If I implement anti-CORS by only allowing my client-side js to call my API from a specific domain (access-control-allow-origin = mydomain.in) with a specific api key, is that a good practice?

I will also be implementing API GW authorizer which rejects api calls made with my client-side js exposed api key if the http_origin isn't mydomain.in. As far as I can tell, this will protect me from people using curl, Postman, or Insomnia to make API calls using the api key they extracted from my client-side js code.