Public endpoints like /events don't require a key. Organizer-scoped endpoints such as /my/events and /my/stats require an organizer API key, generated from Dashboard > API Keys, passed with your request.