I've developed a Chrome extension that I plan to publish to the Chrome Web Store.
On the server side, I've implemented OAuth 2 (using access tokens and refresh tokens) with support for generation of application ID and secrets (similar to how Facebook does it) that is exposed via a private API.
The extension has an application ID embedded inside it along with an application secret that it will first use to request for an access token. I use the application ID to ensure the request is coming from my chrome extension and not elsewhere. Of course, I do understand this can be spoofed, so, I do have rate limiting in place.
But, I was wondering, how do I actually secure my API in this case? In particular, if my application secrets can be easily reverse engineered from the chrome extension. And are there still any benefits to having a refresh token mechanism in place?
How do popular companies achieve this?