Talking about hardcoded api keys, what’s the usual approach when dealing with a mobile app that talks to an api? Users don’t need auth to use the app (they do l

Talking about hardcoded api keys, what’s the usual approach when dealing with a mobile app that talks to an api? Users don’t need auth to use the app (they do login via an alphanumeric code they get via marketing). I only know how to do this properly via auth flows (user inputs username + passwd, then app calls the api for a user jwt, the app then uses the jwt in subsequent calls). I don’t think using this flow makes sense when the user “logins” via a simple alphanumeric code (which is of length 5 and anyone could guess)