Increase password_hash db field size to VARCHAR(100) (werkzeug-formatted hashes wouldn't fit).
Make HTTP auth return false if the user doesn't exist.
Use Flask-Restful for implementing the API.
Move API resources into separate files.