Most endpoints should not answer just anyone. Authentication proves who is calling; authorization decides what they may do. Both start with a secret the client sends with every request.