Calling an API to do authentication / user login

It’s better not to do so. And I’m completely against overriding the default authentication mechanism simply because of WordPress and it’s plugins usually are depended on the website’s database.

But if you’re really into this situation WordPress provides a filter called authenticate:

add_filter( 'authenticate', 'wpse75679_auth', 30, 3 );
function wpse75679_auth( $user, $username, $password ) {
    return $user;
}

Just make sure you’re returning an instance of WP_User when your authentication is done.