HaJ3FgupAm8RrDJW3MHgT9X7Ft27eVaD
What is that? That's a hard-coded API token that Flock cameras use to identify themselves and get OAuth credentials, which can then be used to talk to Flock's production servers. Like, anyone on the internet can probably do this right now.
You give each camera its own token, and validate it with hardware ID.
Even better, give them hardware token, that can sign, but does not leak its keys.
In either way, you can ID the device, and block unsold and confirmed stolen/damaged ones. And never accept traffic from anything else.