The original ICE credential APIs make approximately zero sense. Basically the clients need the password, so there's nothing stopping them redistributing it, making the whole thing rather pointless.

There's now support for third-party auth (i.e. oauth). It's not really fool-proof on its own, however you can at least then disable access to those who abuse the system. However, for this to work you need to have an oauth provider i.e. sign-in, which may be non-desirable.

> credential: 'd0ntuseme'

Might just be an example.