Is OAuth 2.0 mandatory?

Answer:
OAuth 2.0 client-credentials is the primary method; for low-risk read-only endpoints, an API key can be used as fallback.

Source