In general, control who accesses the API and prevent from being hacked or manipulated. Worried that credentials/private information are stolen as well. Basically we do identity verification so as secure as possible without over complicating things?

Wonder if JSON Web Tokens with OAuth is enough or is 2FA the way to go for max security.