I am designing a .NET Web API-based REST API that would be accessed via a mobile banking-like app.
We plan to use OAuth 2.0 Resource Owner flow for authorization. All requests will go through HTTPS with server certificate and will include the signed refreshable access-token received by the Authorization Server.
What other security measures should be implemented by the API and the mobile client in this security context.
Is request key-HMAC signing similar to AWS necessary? Is message encryption necessary? What do mobile banking apps typically implement in this scenario? Is it necessary to track app installed instances (by having them send a Guid with the access-token request)
A specific real-world set of instructions recommended for mobile banking APIs would be greatly appreciated. How do Chase, Wells Fargo, Bank of America, etc. do it?