Hiding WordPress REST endpoints from public viewing using Basic Authentication

Here is my solution.
Inside the callback function I validate Authorization from the header like this:

function callback_function($data) {
    //Get HTTP request headers 
    $auth = apache_request_headers();
    //Get only Authorization header
    $valid = $auth['Authorization'];

    // Validate
    if ($valid == 'Basic Base64UsernamePassword') {
        //Do what the function should do
    } else {
        $response="Please use a valid authentication";
    }

    return json_encode($response);
}