Instead we can let the frontend handle these requests
by passing a set of temporary credentials with
restricted (read only) permissions.