a static secret like that might be effective enough as long as you're handling it correctly; ensuring https is used so it's encrypted in transit, and handling it securely on your server