The services work fine by now and anyone can query the details of our products. That may be a problem. The details of the products are not necessarily public information. We have to ensure that we serve the data only to partners who are eligible to see it.
To ensure that, we need something in the request that proves that the request comes from a partner. This information is typically a password or some other secret. It could be placed into the GET request parameters or into the HTTP request header. It is better to put it into the header because the information is secret and not to be seen by anybody.
Note
The GET parameters are a part of the URL, and the browser history remembers that. It is also very easy to enter this information into the browser location window, copy paste it, and send it over a chat channel or over e-mail. This way, a user of the application, who is not so educated and concerned about security, may disclose secret information. Although it is not impossible...