How should authentication and authorization be designed for production in Web API?

Use OAuth2/OIDC or JWT where appropriate, policy-based authorization, least privilege, HTTPS, and key rotation. The implementation should be justified by measurable requirements, kept as simple as the problem allows, and validated with realistic tests, telemetry, failure handling, and documented tradeoffs.