not having access to the secrets. or you mean, like if someone makes a fake client for your app? you can add additional heuristics to determine the legitimacy of a client, but attackers don't usually do that unless they're trying to side step your rate limits.