The CTX APIs use basic HTTP authentication with base64 encoding.  This requires a user name and password to be submitted with each API request.  The client proxy framework (e.g. Axis) should have a simple way to set this up.  The user needs to be configured in the CTX Admin application with role of API.  A password is configured also.  Then this combination of user name and password is used for the basic HTTP authentication.
 
Basic HTTP authentication is sufficient given the assumption that the client portal and CTX reside in a private protected network.  In the future, the APIs may provide an SSL/TLS certificate-based authentication for greater security and deployment flexibility.