The last one is the easiest and correct way of achieving this. Whatever goes to client, stays there. There is no bulletproof way of hiding it on the client. Regarding a guide to no.3 option - It's pretty straightforward. Just build an API like any other API and let your client talk to it.