In order to access the API securely what do I need to do?
Is it as simple as using
https and letting my CMS manage session authentication?
CiviCRM Stack Exchange is a question and answer site for administrators and users of the CiviCRM Constituent Relationship Management software. It only takes a minute to sign up.Sign up to join this community
Whether or not https is used would be dependent on the CMS, but this is certainly recommended. Other than making sure the Access AJAX Api permission is set up for a particular CMS user, you will also need to pass a user api key that is assigned to the CiviCRM contact record associated with that CMS user.
The REST API requires that you specify the site key and an API key. Details can be found here.