Protecting API if user is not logged in

Question

I have a MYSQL DB which holds tables with data.

I then get the data in my project using PHP which returns JSON to a page

I also have a login system which works