We are experiencing fraud with our open API, so we're turning it private.
Let's suppose that I'm using OAuth and Bearer token to authorize who can access my API.
Request: App -> Credentials -> Auth Endpoint ... Response: a bearer token to be used in future requests
But even with HTTPS an attacker can user Fiddler, Burp, Charles and other proxies to intercept and see what credentials I'm using with a self signed root certificate installed in the proxy machine and trusted in mobile device.
Request: App -> Credentials -> Proxy ... Intercepted Credentials Request: Postman/Attack Script -> Valid Credentials Intercepted -> Auth Endpoint ... Response: a bearer token to be used in future requests
So the attacker stole the credentials and is authorized to use the API until the token expires.
How can I avoid this?