How to Extend Identity Security to Your APIs