Is remote verification fully open over http with no user credential verification or rate limiting? If I were to implement remote verification in an app, I would

Is remote verification fully open over http with no user credential verification or rate limiting? If I were to implement remote verification in an app, I would want to have the user logged in to an account prior to adding a license key. You could accomplish this by putting the KMS behind a proxy but this seems like a likely attack surface if using this the way it’s outlined in the docs.