All apis have to authorize and authenticate if they do sensitive stuff. Otherwise youre asking for it.