Depends on the scope of the API of course, but it's a good rule of thumb for any API with private auth