I have a running web app that uses an external OAuth provider (Reddit) to log in with. I want to integrate this app with someone else's mobile app and I want to make it as easy as possible for developers and users. I don't want to have to display multiple OAuth confirmation windows and store multiple tokens if I don't have to.
My question is, what are the security concerns around re-using an access token for multiple apps? Could the mobile app simply pass a currently valid, Reddit access token to my web app and I use that instead of fetching my own refresh and access token from Reddit? Would that create security concerns since the token is technically being re-used even though it's by the same "app family"?
The token would be passed in a header to the web app / API and the web app and the mobile app would then share the same app secret.
My gut says this probably isn't a great idea and/or against most ToS. But this would be a much simpler solution than having to manage another token in mobile app just so it could talk to my web app.