It is the same with app keys, you have to gate it behind an intermediary/signing server and implement any impersonation/abuse detection there. https://casper.i

It is the same with app keys, you have to gate it behind an intermediary/signing server and implement any impersonation/abuse detection there. https://casper.io/ https://casper.io/ is an example of doing this (for SnapChat) - they used to take registrations for their own API. Not sure how it's working out for them these days.