I actually asked them this just last night. Here's the response I got: So right now, you're restricted to using the master key for the REST API (and thus, java

I actually asked them this just last night. Here's the response I got: So right now, you're restricted to using the master key for the REST API (and thus, javascript applications). We have plans to make this more secure in the future in the same way as we do with our SDKs. For our SDKs, we have a few ways to secure your app, via class level permissions and object level permissions (ACL): http://www.parse.com/docs/data http://www.parse.com/docs/data You're able to lock down permissions on the client key, and this should be able to secure the majority of apps that you want to make. But, this won't work with the REST API.