Best practice for secure access with APIs ()