I'm using OAuth2 to secure an API. This API will be used solely by a known website and some Cordova apps.The website will send always send a corresponding referer header.The Cordova app will always send an x-requested-with header.I have two similar questions regarding this.May (or should) these headers be used to verify a client identity when requesting an access token?May (or should) these headers be used in addition to the granted access token to verify the client identity?
Should requests using OAuth2 rely solely on the bearer token?
oauth2