As far I know it is not really handled. Actually the same problem exists in a c++ app. Getting a string section form a binary is not that difficult. I do not see how it may work without using similar system to DRM, so essentially you need to have a controlled environment in which you execute the app. Normally security is done on the server side, and any app that has knows how to use exposed api can connect, think about online banking.

Btw. I hope that I understand backendId and backendSecret correctly. I assume that these are used to identify and authorize an application itself.