其他网站或设备可以访问骨干API

Question

I am new in backbone, I am using php with Laravel framework as my server side language. I read to creating a single page application, I should create an API on my server side.

1. Is this right (I should have an API for backbone single page application)?
2. Is this secure? (Other websites or devices like Android software can access it?)