How should I do my authentication and authorization for my REST API?

Question

I am currently building a SPA, which is a to-do list. I want the to-do list to sync with multiple devices, like your desktop and your phone. To do this, I want people to be able