Security to private API

I have a cloud API that returns data in JSON format, it is information that should be private, so the API must respond to data only to some authorized people when they make the request via HTTP. I would like suggestions for security strategies to limit the access of the answers to only some authorized requests, I thought to use the IP to block or the MAC Address, but they are out of the question, I would need something like a form of authentication.