Hi @ONiel,
What I have seen, and what I have used ( with Google API ), is that the server issued an authenticated user a token, such as a JSON Web Token, and the user session must remember this token.
Next time access, it needs to send this token along in the request, for example, in the Authorization header. The server looks for this token and authenticate the request in order to grant access.
The last Google API I have used is Text To Speech API, Google issues a credential file in JSON format, which we need to include everytime we access the API.
Best regards,
...behai.