There are a couple of ways to do authentication and authorisation, and it's probably a good idea to read a bit about the different standards - for example, https://oauth.net/2/ or https://openid.net/connect/ . But just to give a rough idea of how these things happen: an API key can be as simple as a random string of characters that identify an authentication object in your database. When creating an API key, you: Generate a random string, e.g. a UUID Create an auth object Store the auth object in your database Store the API key in your database and make it point to your auth object via. a foreign key An auth object can look like this: { email: "[email protected]", username: "Johnnyboi", role: "Admin", canAccessApis: [ '/products', '/users', ... ], canDeleteOtherUsers: true, canDeleteOtherAdmins: false } ... you just put whatever information in there that you want. Then, you give that API key to the user and tell them to append it to every request they make to your API. Typically, the API key is included as a header called something like X-API-KEY. Then, in the backend at your API, on every request you: Extract the header in which the API key should be Look up the API key in your database and get the auth object it points to Use the auth object to check if the user is allowed to do what they want to do You typically write middleware for doing this so you don't have to copy that code for every endpoint you have. This is a very simple way of doing it, but will work just fine. Still, I strongly recommend reading up on some more sophisticated ways of doing it, such as OAuth2 or OIDC. Answer from Iklowto on reddit.com