Correct - this is basically for internal use and partners. If we need basic users to access this then we can authenticate against a password or generate a session token