Auth for API usage is up to the user to implement, but you could borrow code from the internal system/admin/user package to do password based auth & check JWTs. All of the API interactions w/ the system have hooks (see here: https://github.com/ponzu-cms/ponzu/blob/master/system/item/i...) so you can do auth verification, data validation, etc all within the req/res lifecycle.

According to the README it depends on golang.org/x/crypto/bcrypt and github.com/nilslice/jwt so it seems likely to have authentication on board and a way of using JWT tokens for API access.