Any request executed via the Web API will need to be authenticated with the Dynamics CRM instance. The only exceptions are the requests that are executed inside the web resources and plugins deployed in the organization itself.

The possible scenarios are as follows:

• With JavaScript/ plugins: When the Web API is used in web resources embedded in entity forms or ribbon commands, the user does not need to provide explicit authentication parameters while executing the API.
• When executing code outside Dynamics CRM on an on-premise server: In these cases, the code needs to pass the network credentials while calling the API. The following is a code snippet showing how to pass the credentials in HTTPWebRequest:

       HttpWebRequest request = 
       (HttpWebRequest)WebRequest.Create(url);
       request.Method = "GET";
       request.Credentials = 
       new NetworkCredential(UserName, PassWord);

• When executing code for Dynamics 365 online or an on-premise internet-facing deployment: The authentication needs to be handled via OAuth. The following is a code snippet showing how the credentials are passed:

       UserCredential userCredential = new UserCredential("
       <office 365 user name>", "<Office 365 Password>");