You don't have to support the legacy API for forever. But you do support it for a while so people can still use it and don't have a short time frame to update their code. I would also say to have a simple data format. Usually JSON is what people are going to interact with. Also, there are different authentication systems for APIs like API key,. Like Kelly mentioned, or you can also have like all these different options for authenticating your API.