[alex_duf]

I would agree, always start simple - unless you manipulate sensitive data - a shared secret is a good place to start (api-key or basic/digest auth)

You can always introduce other forms of authentication later. I have a slight preference for basic/digest auth as the secret isn't part of the URL, and therefore not cached/logged by any network equipment.

[webster23]

The api-key does not need to be part of the URL, you can also put it in the Authorization header.

edit: typo