IP and domain cannot be easily spoofed. Spoofing the source of a TCP connection is almost impossible: TCP uses random sequence number when negotiating the connection, and the attacker would need to guess the number, while not being able to see any reply from your API server. Spoof the domain would involve the attacker compromising the zone records for the attacked domain. Doable, but is not something trivial.
If this static website have a public and fixed IP, you can trust
$_SERVER['REMOTE_ADDR']. A malicious client will not be able to forge its own IP, and any other header is not useful for him. If the client is behind a proxy or NAT,
$_SERVER['REMOTE_ADDR'] will have a private address, like
192.168.2.34, but I don't believe your static website would be hosted on a private address.
Besides PHP, you can use you database access controls to allow only that specific IP, and nothing else. If you are using Apache 2.4, you can load the
authz_core module and add
Require ip 188.8.131.52 on the
Directory entry on the domain config file, or on the
.htaccess file on your API folder.