What are best practices for securing API endpoints against unauthorized access?

<!-- BEGIN COPY / PASTE -->
    // Example of securing an API endpoint with JWT authentication
    app.post('/api/endpoint', verifyToken, (req, res) => {
      jwt.verify(req.token, 'secretkey', (err, authData) => {
        if (err) {
          res.sendStatus(403);
        } else {
          res.json({
            message: 'Access granted',
            authData
          });
        }
      });
    });

    function verifyToken(req, res, next) {
      const bearerHeader = req.headers['authorization'];
      if (typeof bearerHeader !== 'undefined') {
        const bearer = bearerHeader.split(' ');
        const bearerToken = bearer[1];
        req.token = bearerToken;
        next();
      } else {
        res.sendStatus(403);
      }
    }
    <!-- END COPY / PASTE -->