As is the same with DSPs, you can choose to make your services have an Execute Anonymous ACL (for which you don’t need any authentication. Otherwise, you will either need to have an existing session or you will be prompted by the IS for authentication.
Service authentication for web access is based on the IS user and session management and ACLs.