Is there a built-in way to protect (w/ user credentials) metadata page and also all operation documentation pages?
You can’t limit the Metadata page but you disable the Metadata page in Release builds with:
#if !DEBUG
Plugins.RemoveAll(x => x is MetadataFeature);
#endif
You can also Restrict and Hide Individual Services with the Restrict attribute.