I am planning to use the Flickr API in a Windows Universal (UWP) application, written in C#. Early on in my prototype I stumbled upon a security flaw that I have been unable to find a reasonable solution for.
To authenticate a user, I need to obtain a request token using my API key and shared secret. At the moment this information is hard-coded in the application but this can be easily obtained by disassembling the executable with ILSpy. The risk here is that another application can behave as mine and use up my own API call quota.
I did some research but couldn't find any concrete solutions to the problem. Most people seem to suggest a proxy (with no extra details on how this would work in the context of authenticating) or just leave the details hard-coded and generate new keys if it became a problem (which seems like an evasion rather than a solution).
What are my options in this scenario? Am I worrying about something that's not a huge problem? Are there known secure ways of doing this sort of authentication that I'm missing?