So I guess you could disable all of that, and maybe hardcode some URL parameter into an endpoint. But it feels like a roundabout way to get something that has a shared secret in a config file