In order to access the API securely what do I need to do?
Is it as simple as using
https and letting my CMS manage session authentication?
Whether or not https is used would be dependent on the CMS, but this is certainly recommended. Other than making sure the Access AJAX Api permission is set up for a particular CMS user, you will also need to pass a user api key that is assigned to the CiviCRM contact record associated with that CMS user.
The REST API requires that you specify the site key and an API key. Details can be found here.