Then to log the user in you’d either
- use implicit auth
- have the user provide their own ClientID and ClientSecret to the app
Since you can’t share your ClientSecret, but you can share a ClientID
Rate limiting is roughly, by Token/IP key pair. So the instance count doesn’t matter in this case.