GlobalLogic interview question

How to secure a Web API