Why do we need password to access API?