I've usually used nginx for this purpose, proxying requests to a 3rd party server but tacking on authorization headers, for example, keeping them secret from the client. This strategy's always works great for me, but I guess it's limited to fairly simple pass-through use cases.

This seems cool if there are more complex needs or configuration that can't be done with simple proxying and nginx rules.