I'm developing an API and different apps to access to it, each with different scopes, including a native mobile app, and I'm wondering what would be a good strategy to authenticate my own native app to my own API (or more specifically my users).

I can't find a recommended method to guarantee that it is really my client (in this case a native app) which is talking to my API.

For example, if I implement the Authorization flow to authenticate my users. Let's say I have a server acting as the client mobile.mydomain.com, so my mobile app make requests only to mobile.mydomain.com and mobile.mydomain.com is be able to securely talk to api.mydomain.com as the client id / client secret is never exposed to the public.

So far so good, api.mydomain.com is sure that calls are from mobile.mydomain.com however mobile.mydomain.com isn't sure who is sending requests to it and it's still possible to impersonate my mobile app by making another app that just includes the same login button and does the same oauth2 process and finally get a token to continue talking to mobile.mydomain.com.

How is that different from using the Password flow (which isn't recommended I know) and embedding the client id / client secret in this case? (client_secret being completely useless in this case)

=> basically from the api point of view, it just needs to know what is the client id.

How does google to make sure that a request is really from the Gmail app and not from another app doing the exact same thing with the same redirect uri etc? (which wouldn't be harmful anyway as it requires a username / password). I guess it can't know for sure

PS: I'm aware that OAuth2 isn't for authentication but for authorization only