How is access to the API granted?

Answer:
Privately via a unique authentication token per client; tokens are not tied to specific IP addresses.

Source