Yep, you need at least a shared secret that isn't published anywhere for sending the events (reading them is fine if you're public).