Form3 interview question

What authentication/authorization mechanisms would you consider for a backend API?