I would like to know how auth services, such as OpenID Connect and OAuth, are able to distinguish between a first party application over a third party one - in particular for clients such as mobile applications, since they obviously can't securely hold some predefined key/identifier.
An example of this would be the Google auth system. When signing in for gmail, there's no prompt regarding scopes; contrast to StackExchange using Google for an account which would show developer info and requested scopes.
I can understand how this could work for an SPA since you could set restrictions around the redirect URL but how would you ensure that the request was coming from a particular mobile app? Is that even possible to truly do securely?