Securing the Actions Server

I’ve been digging and cannot seem to find any indication that it is possible to add a token or jwt to the action server or to configure the action_endpoint (in endpoints.yml) to tell rasa core to make a secure call.

Is there such a thing? The action’s server seems like a fairly important thing to secure so I can’t imagine that there is no story here.

Also, is there a way of running custom actions directly in the rasa_core server without needing another api to secure?

Thanks in advance.