Are private APIs not vulnerable to DDoS?

Hey, im studying DDoS right now, and havent been able to answer this question:

I know webservers are vulnerable to DDoS attacks, because they have to serve the content to basically anyone requesting it. But what about a private API, that requires a API token to access?

Such API is not vulnerable (atleast as much) to a DDoS attack, as the DDoS attack wont cause as much load on the server, as the server will check for the existence of the token in the request, and if it isnt there/is wrong, the server will immediately terminate the connection, right?

TDLR:

A private API is not nearly as much vulnerable to DDoS attacks as a traditional webserver? Is this true?