I think there's a few issues with shared secret and have tended to use OAuth for anything "serious". If your API gets into adding and updating addons I would call that "serious". I'm not sure what the intended client of all this and I'm just jumping into the pull request. I'm sure other people would have more opinions on the matter :)