Even then you could just put a breakpoint in the Fukime constructor and read the raw string?

Heck, even if the authentication step was 100% secure, what's stopping a malicious user from calling increase("farms") on a previously authenticated Fukime object? The Fukime instance is shown to have direct access to "global" variables, so the user wouldn't be limited to screwing with their own data.

This kind of logic belongs server-side (and this obviously isn't a server-side API, because the examples provided are for Android and iOS.)