Of course it works, and can be the only protection. It just depends on your risk profile. I can hide my service with a random key and you will never get to it.

Of course it works, and can be the only protection. It just depends on your risk profile. I can hide my service with a random key and you will never get to it. This is how a lot of data is shared when you do not have identity management. Of course once you share this URI then the one who what it can access the data. But again, it is a choice. Security is difficult, especially when someone jumps on without assessing their threat profile.