I think that IP spoofing is much easier than explained in the other answer. This can be achieved without any admin right on your network. Just the right software (or some consumer grade devices). Even hardware MAC address isn't reliable to whitelist devices. No, this approach isn't protecting anything.
The client secret that you are talking about looks pretty much like a client certificate. You could opt for a hardware certificate (i.e. on an USB key), or a commercial certificate installed for the user account in a protected "certificate store", or a temporary certificate (that's acquired during the sign-on process, but this requires a local ca authority and is more complex to set-up).
Of course, such a client certificate makes only sense if nobody can intercept parts of it over the net. So this requires the set-up of a secured HTTPS communication (i.e. HTTP with TLS or SSL, which could also take care of client authentication).
Further reading: