API authentication, secure endpoints