Handing an upstream key to a client is the fastest way to lose control of it. Once it is in a mobile app or a browser bundle, rotation is the only remedy.
Hisoka keeps upstream credentials on the server and issues its own keys. A revoked gateway key stops working immediately, and the provider secret is never distributed.
