add_filter( 'authenticate', 'my_auth', 10, 3 );

function my_auth( $user, $username, $password ){
    return $user;
}

function my_auth($user, $username, $password)
{
    // Make sure a username and password are present for us to work with
    if ($username == '' || $password == '')
        return;

    /* my_api_section
     * your API code goes here
     * Assuming it returns 0 for username and password missmatch
     * and 1 for match; store the result in $ext_auth['result']
     */


    if ($ext_auth['result'] == 0) {
        // User does not exist,  send back an error message
        $user = new WP_Error('denied', __("ERROR: Username/password missmatch or not exists"));

    } else if ($ext_auth['result'] == 1) {
        // External user exists, try to load the user info from the WordPress user table
        $userobj = new WP_User();
        $user    = $userobj->get_data_by('email', $ext_auth['email']); // Does not return a WP_User object
        $user    = new WP_User($user->ID); // Attempt to load up the user with that ID

        if ($user->ID == 0) {
            // The user does not currently exist in the WordPress user table.
            // So creating the user.
            // Setup the minimum required user information for this example
            $userdata    = array(
                'user_email' => $ext_auth['email'],
                'user_login' => $ext_auth['email'],
                'first_name' => $ext_auth['first_name'],
                'last_name' => $ext_auth['last_name']
            );
            $new_user_id = wp_insert_user($userdata); // A new user has been created

            // Load the new user info
            $user = new WP_User($new_user_id);
        }

    }

    return $user;
}