In this case I would also need to expose credentials to the end user, which is something I would like to avoid. As an alternative I am thinking of using a token that would replace sensitive credentials, but what concerns me is how to prevent an end user to reuse or recall rest api service misuse that same token with different params?
Bottom line, how to successfully protect application so only application can consume rest api and not the end user himself?
This question raised a couple of doubts so I would like to make myself clear.
What stops any user to change query string to
What stops any user to get our credentials for third party api and consumes it without permission?