In the SDK, the output API will be called from user's device directly without going through your own server. For security reasons, we only need your Public API Key when developing with the SDK.
So you will need to allow users to access the output API without API secret as well if you are going to setup Over-the-air update.
That means anyone with your Public API Key will be able to download the translations via OneSky directly (just like the devices with OneSky SDK plugged).
All other APIs will remain private even if you allow public access to the API /string/output.