We will use an in-memory store. The following snippet shows the configuration of a couple of users with different roles:

@Configuration
public class SpringSecurityConfiguration extends WebSecurityConfigurerAdapter {

    @Autowired
    public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
        auth.inMemoryAuthentication()
          .withUser("user1").password("{noop}user1-password").roles("ADMIN");
        auth.inMemoryAuthentication()
          .withUser("user2").password("{noop}user2-password").roles("USER");
    }

}

We are configuring a couple of users for the API—user1 and user2.