How does a post purchase upsell app server work without access tokens?

[UsamaDar]

I just went through the Post Purchase Upsell tutorial. One thing is not clear to me. The example contains two components. 

1. Post Purchase Extension 

2. App Server 

The example queries the Shopify Store in the 'app server' to fetch the products to show as the upsell offer. However, the app server uses an Access Token, for which I had to create a separate app in the Shopify admin and provide the access_code to the app server. I also had to provide API Key etc., to sign the changeset. 

However, it will not work in real-life scenarios. The merchant will install the post-purchase app to their Shopify store. The app server is running somewhere else, and the merchant must provide the Access token or API key and secret. When I install the post-purchase upsell app from the Shopify store, I don't have to provide any secrets etc, to them. How do they work? i am very confused..