Looker's API authentication endpoint returns an access token to use on subsequent API requests. Access tokens expire after 1 hour, at which point a new access token must be obtained.
Example:
$ curl -X POST "https://mylookerhost:19999/api/3.0/login?client_id=myclientid&client_secret=myclientsecret
{"access_token":"someaccesstoken","token_type":"Bearer","expires_in":3600}
someaccesstoken
is then passed as a header on each API call:
$ curl --header "Authorization: token someaccesstoken" https://mylookerhost:19999/api/3.0/user
Or as a URL parameter:
$ curl https://mylookerhost:19999/api/3.0/user?access_token=someaccesstoken