Ask HN: How do I build my first secure public API?

I have a built a simple incident management platform for small teams with only basic features. Some of the earlier set of users and customers have asked for an API access. I have built applications for years but i have never built and released my own public api including secure key and token to each account, etc. Can you guys please help me point in the right direction about how to get staretd? A deep dive article would be great too. Stack ==> NodeJS, MongoDB, Redis and only jQuery on the frontend.