I cannot help you with paid products without an active subscription. So I can't go into explicit detail, but yes CB Auto Actions can be used to create REST endpoints to output whatever you like and authenticate however you like. Examples have been posted on the forums at other users requests though so you can try searching and using those as an example.

www.joomlapolis.com/forum/developer-members-support/245868-create-linked-cb-gallery-media-items?start=30#335321

This example creates a new media entry in CB Gallery and responds with a JSON structure.

www.joomlapolis.com/forum/developer-members-support/245843-default-password-and-redirect#333857

This example logs a user in using their username and password from an external form and responds with login success.

You're basically only limited by your own coding ability as you can use Code actions to execute whatever PHP you need and can utilize CB and Joomla APIs within it. Code conditions are also supported so you could easily implement your own custom authentication as well. Typically just a API secret token (don't use these for public usage like from JavaScript) would be enough.

Aside from that consider creating a new Joomla API plugin then you can use Joomla's API endpoint for whatever you're needing.

We'll have official API endpoints for most things at some point in CB 3.x including authentication (probably OAuth).