is shared secret the best authentication method to use for this?