Even if they auth every user, what's stopping me from making my own API key and feeding it to my favorite app?