Question

Browsing though the Foursquare API documentation, I noticed that when obtaining an access token with ajax there is no need for a secret key (for obvious reasons). But this makes me wonder what is even the point of having to register apps with foursquare in the first place if you can just fake being any app by using their client key. Why do they allow this?

https://developer.foursquare.com/docs/oauth.html

Answer 1

Your answer is in the document you referred to

Since each credential is tied to a particular URL

The point is Foursquare is looking at the URL of the requesting script for security. If there is no registration there is no URL to tie the credentials to.