It's common for client applications to encode a client secret. Many API client apps use a model like this, for example Firebase calls their equivalent token an

It's common for client applications to encode a client secret. Many API client apps use a model like this, for example Firebase calls their equivalent token an API Key. The "secret" in this case is really being used to select a context. So the secret you'd embed in your copy of the app would differ from mine, and it would point to your database, not mine.