I'm using OAuth2 to secure an API. This API will be used solely by a known website and some Cordova apps.
- The website will send always send a corresponding
- The Cordova app will always send an
I have two similar questions regarding this.
- May (or should) these headers be used to verify a client identity when requesting an access token?
- May (or should) these headers be used in addition to the granted access token to verify the client identity?