get products without AUTH

I am building a webshop with React, Wordpress v4 and Woocommerce Rest api v2.

I am a bit confused on how to proceed with authentication. I understand that for some requests like place an order or create a new product I need to authenticate.

But I also need to be able to just retrieve all products for a customer who visits the site for the first time and just wants to browse through all our products. What is the best practice here?

My thoughts are:

• Create a public, separate layer with PHP or Node which securely stores the Woocommerce API keys and provides public endpoints (only GET, i.e. GET /products)
• Access those endpoints via JS/React and render the products
• Create another separate layer for placing orders which requires the costumer to authenticate (i.e. POST /orders)

Also, instead of adding a separate layer I could use the Wordpress function add_action( 'rest_api_init',...

Is there a better way to do it or am I missing something? Or can I retrieve the Woocommerce Products somehow via the Wordpress API endpoints without api keys?