Thread:Project:Support desk/feed from private wiki/reply (12)

You are correct. But still you need readapi rights, since that's the first thing that gets checked, and logged out users don't have that right in your wiki. This may or may not be considered a bug.

You may try to file a BUGREPORT about that so the readapi right is checked in this case for the user in wlowner, if the providen token is correct.