Passport is a great tool to get started with authenticating your APIs.
You can use the many 'strategies' available to signup users. You can use the token strategy to authenticate your API calls.
Next step would be add an SSL certificate to your server and use the secure https layer to make your requests. You could head over to Let's Encrypt to learn more.