API authentication with AWS ALB

This should provide what you are looking for.

https://docs.aws.amazon.com/elasticloadbalancing/latest/application/listener-authenticate-users.html

Authenticate users using an Application Load Balancer

You can configure an Application Load Balancer to securely authenticate users as they access your applications. This enables you to offload the work of authenticating users to your load balancer so that your applications can focus on their business logic.

The following use cases are supported:

• Authenticate users through an identity provider (IdP) that is OpenID Connect (OIDC) compliant.
• Authenticate users through social IdPs, such as Amazon, Facebook, or Google, through the user pools supported by Amazon Cognito.
• Authenticate users through corporate identities, using SAML, LDAP, or Microsoft AD, through the user pools supported by Amazon Cognito.

Apart from above, another common pattern is to delegate authentication to the backend that the ALB is fronting, as ALB it is just a load balancer.

As ALB only supports cookie based authentication, you might want to use API Gateway Lambda authorizers.