How to authenticate without the need of a consumer key

Question

Basically, I'm trying to figure out a way to authorize an application to use the Tooling API, but I would like to not have to set up a Connected Application. I've seen this question, but it doesn't really help me understand how to do it.

I've read about the Web-Server auth flow and the User-Agent flow, but both need a Consumer Key, according to the docs. What am I missing? If the only way to do this, like the previously cited answer states, is to use a SOAP login call and then with the key, do the REST calls, why is that?

Answer 1

There are several possible ways to authenticate your Client App making API calls to Salesforce: OAuth 2.0, SessionId and SOAP SessionID. That's it.

(1) Understanding Authentication with OAuth:

Salesforce uses the OAuth protocol to allow users of applications to securely access data without having to reveal username and password credentials.

(2) As @sfdcfox states in his answer, SessionId is basically used for testing purposes. And this is fair because SessionId is valid as long as user's session is live.

(3) As a third option you can use the login() SOAP call that in case of success will return LoginResult with sessionId which you then use in API REST calls, like here.

Although with option 3 you don't need to set up a connected app, you will have to deal with 2 APIs SOAP and RESP, which might not be very convenient.