For the first release of import/export this is how the endpoints are protected :
import : Basic Auth using VariantID and VariantSecret
export : Falls under the Realm of KC