Hi Ali,
That's a somewhat broad question. It might be easier to answer if you could clarify or specify exactly what you're looking for.
A very basic and general answer would be that we treat it like a GUI connection - meaning that you need to add your IP to the approved list (in the API blade settings) and have a valid user name and password over a secure SSH connection.
There are some options for the user to circumvent some of those protections - such as the use of the root flag or by using the unsafe flag to ignore certificate errors, but those option are only available for administrators who already have access to expert credentials.
Hope that helps,
Yonatan
