Do we have to have our own OAuth servers for API authentication?

No, you don't--instead of having to authenticate users, everyone authenticates against our UCF OAuth/authentication server.