External applications - access policies

In my Aiven PostgreSQL deployment scenario, I plan to have external PC desktop applications (with a large number of human users, up to millions) that access databases only through the PostgREST API.
The desktop apps may be written in any programming language, just relying on HTTPS and JSON. Each human user will tipically access to the same big database but with constraints on record rows that are user specific/private.
What’s the recommended way in the Aiven platform to manage authenticated/authorized access to the DB from such clients (e.g. temporary tokens) ?