Hi - so we highly recommend that apps using brainCloud utilize the client APIs for interactions from game clients. That API is purpose-built to represent a player -- the entire api is implemented from the perspective of a player of the player - and the built-in security model supports and enforces this.
Mimicking that via S2S is not recommended. It's inefficient and error prone.
Feel free to reach out to us via the support widget if you'd like to have a deeper conversation regarding what you're doing and why.
Thanks,
Paul.