Hi and thanks,
I'm working to improve features and adding functionalities. In a few days the porting for J2.5 will be available to subscribers (I'm finish testing it).

About the timeout, I have notice it too. In my case it is related to a problem to send the activation email. I'm trying to manage it.

About the second question, this is the idea. You can create and publish an "end-point" as a menu item. Then you can start to call this menu link to access to APIs. Each end-point/menu can have its own access settings between:

Free: no authorization required
User: any request is allowed only for a logged user (using login API)
API Key: you need to pass an additional API Key on each request (with the component you can generate and manage keys)

Each end-point has its own settings, but as you probably know, you can call a component even if it is not published (e.g. /index.php?option=com_jbackend&..) so to protect even this requests I added a "default" settings applied to these calls. The initial value is API Key, but can be changed with component options.

Let me know if it is clear now.

Kind regards,
Luigi

Let me know which part needs more details, so I can also improve online documentation.

Thanks,
Luigi