title: Do IdentityServer4 API Resources require a secret?
body: <p>Does not having a secret defined for an IdentityServer4 API Resource introduce a security vulnerability? </p>
  
  <p>I'm a little confused on the Introspection Endpoint, when it is used, and whether or not someone could use the Introspection endpoint to bypass Authorization and access an API without a defined secret (by a POST with just the API name as a parameter). </p>
  
  <p>Is this possible? Or is the introspection endpoint only authorized through defined clients that use something like the Client Credential Grant?</p>