How can I ensure my API is protected against unauthorized access?

<!-- BEGIN COPY / PASTE -->
    // Example of middleware for JWT authentication in an Express.js app
    const jwt = require('jsonwebtoken');

    function authenticateToken(req, res, next) {
      const token = req.header('Authorization')?.split(' ')[1];
      if (!token) return res.sendStatus(401);

      jwt.verify(token, process.env.ACCESS_TOKEN_SECRET, (err, user) => {
        if (err) return res.sendStatus(403);
        req.user = user;
        next();
      });
    }

    app.get('/protected', authenticateToken, (req, res) => {
      res.send('This is a protected route');
    });
    <!-- END COPY / PASTE -->