If you take any ArcGIS Javascript API example that adds a feature layer to a basemap and interchange that REST endpoint URL with one from an ArcGIS Online REST endpoint that is not publicly shared, then when you instantiate the page it will automatically ask you for your credentials.
If the 'hosted feature layer' is not on ArcGIS Online, but on an ArcGIS Server or Portal behind an agency firewall then you can't see it. You could download a particular version of ArcGIS Javascript and serve it up from your local server and then access only your internal data if needed, and somewhere Esri has examples of how set up and use their Javascript API from your own server.
If the data is on ArcGIS Online, and is not publicly shared, but you want only certain people to access it you can share it up to an Online group, or specific accounts, and then those users will need to have an ArcGIS Online login. Otherwise, if you want to handle the login and then push the data request through using a specific online account then you will have to useOAuth2 authentication as suggested by Sage.
