If what you describe is for PUBLIC anonymous then you will need a QAP licence. These are core based currently.
If for internal then you will need tokens per user.
The world is waking up to the art of the possible with QAP. Simply amazing what you can do. As a partner we run a dev test environment and tested embeding objects into our CRM system for example.