Authorization is explained in the docs (done by PostgreSQL). All the bits together here https://github.com/subzerocloud/postgrest-starter-kit