calling web api from javascript

Hi,

we have a javascript application and we would like to call Appian web api to retrieve data.

What is the best practise to secure the calls? 

What is the best practise to authenticate the user? Like is there a way to retrieve authentication key and then just make calls using this key?

Thanks