That depends on how the secret is used by the client to authenticate with the remote service. If the client just sends the secret as part of an authentication

That depends on how the secret is used by the client to authenticate with the remote service. If the client just sends the secret as part of an authentication request, then a proxy would reveal it. But if some form of challenge/response [1] process is used, where the value sent is derived from the secret and an unpredictable challenge sent by the remote service, then as far as I know a proxy wouldn't help. I don't know enough about the details of the Twitter/DropBox/etc APIs work to know if they use challenge-response. [1] http://en.wikipedia.org/wiki/Challenge%E2%80%93response_authentication http://en.wikipedia.org/wiki/Challenge%E2%80%93response_auth...