Yes I don't know of any good solution for client side only applications. And it's a real issue I think. For instance if I have your key, it may be possible for me to access data, post on behalf, etc... of people who signed in with the service on your application