Absolutely not! APIs can definitely be authenticated, either by requiring some sort of unique key that links your request to an account or through other means. In fact, it's actually somewhat less common to see unauthenticated APIs (at least ones on remote systems), even if they're free, since the ability to audit and limit usage is definitely valuable.
