In this blog post, Andre explains two approaches on how to secure a REST API: One works with nginx and the sub-request feature, the other implements the verification part in the API itself.