How do they authenticate to your API?? Do you want to ask normal people to store an API key and remember to rotate it every so often?