Tor itself has a nice built-in method of authentication you can use. I don't know of a good howto, but it's documented in the man page. Search for "HiddenServiceAuthorizeClient": https://www.torproject.org/docs/tor-manual.html.en