Authentication protocols for APIs