Should every API be protected by machine-to-machine authentication? Building my AWS Starter Kit forced me to question that assumption. The mistake wasn't choosing the wrong authentication mechanism. It was choosing one too early.
