What are some good ways to protect APIs?

Hey guys,

I'm starting to work with NodeJS, and I'd like to know more about security. Basically I'm building a API and I want to protect it. Is passing a username and password enough? Do you guys have more experiences in security? Have some ideas?

Many thanks!