How will a self-written API be protected?

Question

API

Good day!
I am engaged in the implementation of the API for my applications on Android / iOS. The API has the ability to purchase goods, and I'm sure that there are "smarts" who will catch requests transmitted. And then there can be bad consequences.
There were several security options:
1. client_id & client_secret of type oAuth 2.0 . But this principle is the most banal. I just give open access to an attacker and he can easily use the API using client_id and client_secret.
2. There was an implementation idea where, when a user was authorized in the application, a request was sent to the server. Next, a key was issued that I generate and store in the database. And for important requests (purchase, profile editing) using this key, the application encrypted JSON parameters in AES256 using this key. And sent the data to the server. But after all, you can initially poison the key to find out what is stored in the request being sent.
In general, there are a lot of options. But very weak! Suggest something worthwhile. Thanks in advance.

Answer 1

SSL + SSL Pinning.
about payment - the server, as it were, should validate transactions separately, and not just trust everyone.

Answer 2

And how do you think authorization in web applications works? It can be caught in the same way and compromise the client.
1) Use https
2) Add a unique signature to each request
You can mix unique data into the signature, device id, some parameters from api, current time, and encrypt it in some popular way.

Answer 3

Look in the direction of JWT (@Fesor somehow advised before;)
https://jwt.io/ A lot of both for mobile platforms and for PHP
If you briefly understand the essence, you can quickly look at this - habrahabr.ru/post/243427

Answer 4

https.
and payment - for sure, the market and the store offer good ways