How to protect ASP.NET Web API 2

I need to implement ASP.NET Web API 2 i.e.

[RoutePrefix("orders")] 
public class OrdersController : ApiController 
{ 
    [Route("{id}")] 
    public Order Get(int id) { } 
    [Route("{id}/approve")] 
    public Order Approve(int id) { } 
} 

I am wondering how it can be protected?

Can we use ASP.NET Identity for that, for instance?

Any clue?