Let's say that my Rest api is secured using OAuth 2. Let's say my client is a mobile App. Let's say that i have an Api call:@Post /increasePoints host:https://www.example.com/increasePoints  amout=10Now Using this api call, one should have a valid Access Token. from my app i have control when to call this function so there is no problem. but Let's say the authenticated user get a hold of the access token. how can i stop him from posting to this api using his access token?Few options that i thought of:sign each call with a special header. use client_authentication with scope points - i've just read about this type of authentication but the user can get the access token with same ease for what i understand.
Secure Rest api from authenticated user
security;rest;oauth2