API URL defaults to no auth