It can be an API only profile, but you also need to check that it has the correct accesss to any objects that the class uses.
e.g. If it requires access to a specific object, in that case you would need to make sure the user’s profile also has the correct CRUD permission on that object.