Best practices for securing NodeJS API created with Swagger

Question

I have created an API with NodeJS and Swagger that works well, but anybody can call it and I want to restrict it to the users that have a valid API Key. Are there any best practices that I need to use for securing the API? Just adding the api key in the request? Generating a token and adding it to the request header?

Answer 1

That makes oauth is born. Look at https://www.digitalocean.com/community/tutorials/an-introduction-to-oauth-2