Question about OA Access of web service

SmartApps & Automations
2

By API Key do you mean the endpoint URL that you get from https://graph.api.smartthings.com/api/smartapps/endpoints:

[
    {
        "oauthClient" : {
            "clientId" : "12345678-1234-5678-1234-123456789012",
            "authorizedGrantTypes" : "authorization_code"
        },
        "url" : "/api/smartapps/installations/87654321-4321-8765-4321-9876543219876"
    }
]

The URL with /api/smartapps/installations/somekey is a reference to the instance of your SmartApp. Normally, you would need to use the OAuth workflow to authorize access to this endpoint (using the Client ID and Client Secret). You can also use createAccessToken() like @625alex does with SmartTiles to create an authorization token that can be used instead of the traditional OAuth workflow [reference].

I guess the short answer is yes, you always have to authenticate some way and approve which devices can be accessed by the SmartApp.