After some talking, especially with @diox I actually don't want to stick with the SharedSecret authentication. I will use it for now because that's easier to debug and work with, but having something doing proper OAuth (be it bearer token if that's simpler) is IMO the way to go, thanks for pointing this out.