Best Practices for authenticating my SDK