Required in the 'it's a good idea because it will make the web more secure and make your customers trust you' sense, not required in the sense that it's something the API enforces.