The onion addresses of hidden services are not themselves secret. The onion address is in fact well known, published in the directory. It's only your server's IP that a hidden service is hiding.

So please, don't treat knowledge of the onion address itself as a secret! You still have to authenticate to your service in some way.