Hiding web service sign-on information

Ladies and Gentlemen of the Midrange and HTTPAPI/FTPAPI Lists:

We have a situation in which we have AS/400 programs (created and running on customer boxes), called from batch jobs, that access web services (which we host), which require a sign-on. Access is via HTTPAPI.

The problem is protecting the web service sign-on information from the prying eyes of potentially malicious users.

If we call a "factory" program or module that vends the information, what's to stop anybody who can see the call in the source from writing their own program to call the factory?

If we provide a "wrapper" that passes the information to the programs that call the web services, what's to stop anybody who sees how the programs get the information from the wrapper from plugging their own programs into the wrapper?

Anybody know of any good ideas in this regard?

--
JHHL