Subscription Apps with login/ registration, how to secure backend api?

after subscribing, I want to have users log in for a few reasons core to the functionality of the app. However, Apple has requirements about this, stating it needs to be optional. however, I want to have my backend layer secure so that we check a user session each time a request is made, without a check its basically open to the public which I don’t like. Without a login, there is no session To provide. we use RevenueCat for managing subscriptions But I don’t want to rely on their servers for checking subscription status…is that the only option?

do I have an option to secure my api layer another way, without login session?