Yii3 REST API Authentication & Authorization Setup

I am working on a REST API using Yii3 and trying to understand the correct way to implement authentication and authorization.

Scenario:
I have a basic Yii3 REST API setup and now I need to secure it properly for production use.

What I want to achieve:

Implement authentication

Protect API routes using middleware

Implement role-based authorization (admin/user level access)

Understand how Yii3 handles security compared to Yii2

Questions:

Does Yii3 provide any built-in out-of-the-box solution for REST API authentication?

What is the recommended approach for JWT or token-based authentication in Yii3?

How should authorization (RBAC or role checks) be implemented in a Yii3 REST API?

Are there any recommended packages or best practices for structuring this?

Any guidance, examples, or documentation links would be really helpful.