The OpenAPI 2.0 version of spec defines an apiKey authentication method, but doesn't require it for any endpoints.