It is the same with app keys, you have to gate it behind an intermediary/signing server and implement any impersonation/abuse detection there.

https://casper.io/ is an example of doing this (for SnapChat) - they used to take registrations for their own API. Not sure how it's working out for them these days.