Make the service inaccessible even to correctly authorized local clients.

Repeat the same token comparison four times and call each repetition a separate layer.

Record attacks but allow every request to retrieve the secret.

Use several controls at different failure points so one control's failure does not expose the secret by itself.