It would be pretty easy to make the system work with private keys and signed headers or even client certificates. You could stop people from sharing by putting a high enough limit on how much you could access or even just from how many ips (ie only two distinct ips in any given 60 minute window) it could be access from. Normal users would never hit those limits, of course, but pretty quickly you would hit those if you shared your access tokens.
