I wrote a blog about protected content through the Content Delivery API with external login providers. https://www.jeroenbreuer.nl/blog/umbraco-headless-member-auth-with-external-login-providers/