diff --git a/src/frontend/main.ts b/src/frontend/main.ts
index fc477df..082108f 100644
--- a/src/frontend/main.ts
+++ b/src/frontend/main.ts
@@ -11,6 +11,14 @@ import settings from './settings'
 import xhr from './xhr'
 
 (async () => {
+  function initClientSecret() {
+    let SECRET = settings.getStr('SECRET', '')
+    if (!SECRET) {
+      SECRET = Util.uniqId()
+      settings.setStr('SECRET', SECRET)
+    }
+    return SECRET
+  }
   function initClientId() {
     let ID = settings.getStr('ID', '')
     if (!ID) {
@@ -20,7 +28,9 @@ import xhr from './xhr'
     return ID
   }
   const clientId = initClientId()
+  const clientSecret = initClientSecret()
   xhr.setClientId(clientId)
+  xhr.setClientSecret(clientSecret)
 
   const res = await xhr.get(`/api/conf`, {})
   const conf = await res.json()
diff --git a/src/frontend/xhr.ts b/src/frontend/xhr.ts
index 8113549..f048224 100644
--- a/src/frontend/xhr.ts
+++ b/src/frontend/xhr.ts
@@ -11,6 +11,7 @@ export interface Options {
 }
 
 let xhrClientId: string = ''
+let xhrClientSecret: string = ''
 const request = async (
   method: string,
   url: string,
@@ -25,6 +26,7 @@ const request = async (
     }
 
     xhr.setRequestHeader('Client-Id', xhrClientId)
+    xhr.setRequestHeader('Client-Secret', xhrClientSecret)
 
     xhr.addEventListener('load', function (ev: ProgressEvent<XMLHttpRequestEventTarget>
       ) {
@@ -60,4 +62,7 @@ export default {
   setClientId: (clientId: string): void => {
     xhrClientId = clientId
   },
+  setClientSecret: (clientSecret: string): void => {
+    xhrClientSecret = clientSecret
+  },
 }