What's the best way to make Authentication (API) in this case?

Hello,

I've been watching the Incremental API (which is a great serie, thank you Jeffrey!). However, Jeffrey used basic Auth to protect some of his methods. The problem is, in my case, I don't have users. I want to make an ecommerce site without authenticated users (you just pick products, fill a form and then we contact the client to process the order). But I still need to protect some methods, for example : an admin want to add a product to the list.

What's the best way to do that?

Thank you!