It's not difficult.
1) Each application has a guid.
2) You do authorization in your application (for example, by email + password) and record authorization for this application (guid) in the database, generating a random token (any key, usually a string), for example md5 from email + time ().
3) Addressing the closed parts of your api, you transfer the guid + token, and your application checks if the token for this guid exists (and is not closed, because you can set its lifetime, or close the user from the application from the logout), then issue a response, and if closed, send for authorization.
This is a very general mechanism, just to explain the scheme of work. In fact, someone complicates, someone changes something, someone leaves as is. For example, instead of writing your authorization, you can perepilit oauth. Although, its write is not particularly difficult;)