# Public vs Private APIs

**URL:** <https://forum.serverless.com/t/public-vs-private-apis/1625>\
**Category:** Serverless Framework\
**Tags:** aws\
**Created:** [April 4, 2017, 8:06am UTC](https://forum.serverless.com/t/public-vs-private-apis/1625 "2017-04-04T08:06:26Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![rwoodnz](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/rwoodnz/32/564_2.png) [@rwoodnz](https://forum.serverless.com/u/rwoodnz)\
**Post date:** [April 4, 2017, 8:06am UTC](https://forum.serverless.com/t/public-vs-private-apis/1625/1 "2017-04-04T08:06:26Z")

</div>

Just getting to grips with server-less architecture and authorisation.  
I can understand a private API say on AWS, the client software getting a token from Auth0 after the user has logged in and accessing those resources, controlled by having that token.  
I can also understand having a public API on AWS that is accessible to anyone for particular services direct to the API.  
What I am wondering about for API services used by the client software for any user on a public website whether that access needs to be secured. If so how do you go about treating a token for that - do you create a special token for it or get a special account on Auth0 and somehow get a token from them?