If the API was totally exposed then it would be a vulnerable endpoint. Also, tokens cannot just be given away for free