How can I protect myself from receiving tokens on behalf of my OK application by other mobile applications?

Question

Classmates

I have an android mobile app. In it, I get an OK token using the OK Android SDK. To get an OK token, I need to register app_id and app_public_key in my mobile application.
What will stop a person who will get the credentials from my application and start using it in his own?
For VK, FB and GOOGLE, the connection of the Oauth application with the fingerprint of the mobile application protects against this. But in Odnoklassniki, I don’t see anything like that.

Answer 1

What do you have in mind? OAUTH is an open protocol.
Client OAUTH only implies the transmission of a valid client_id, which is not secret and can be spoofed.
If you want to ensure that only you are authorized as your application, then use the server OAUTH https://apiok.ru/ext/oauth/server . But it requires signing with the application's secret key, which is easy to catch on the client. Therefore, this option is not built into ok-android-sdk; when used on clients, its security is illusory.
The second authorization option is SSO when the application is OK installed on the device. The signature of your application is not transferred there. But even if it were transmitted, how much could this information be trusted? And how convenient it would be to register new fingerprints for each update of the application, especially considering that there is no difficulty for an attacker application to issue one of the previously registered fingerprints of your application.
In general, the essence of the request is unclear
PS: But you can protect yourself - you are making an application where you run the server part of the authorization through the communication application <-> your server <-> server is ok, while not enabling client OAUTH authorization in your application.