Phishing is an attempt to steal user's personal information such as username, password, credit card number etc. The main idea of such attack is that the attacker pretends to be a trusted web-site which asks the user to re-enter the personal information and in this way steels it.
I own a set of REST APIs and some of them don't require users to be authenticated. Example could be: api/items/index of an e-commerce". Currently, I use Cookie-based tokens from my application, but ...