I have a little trouble understanding, how to use OAuth to secure an API. So I developed a RESTful service, which I would like to secure to authenticated access. I first opted for HTTP Basic + TLS, but then decided to also support OAuth. The Jersey library supports OAuth1. After I got that working, the first consumer of that API will be a web application.
So I need to register a consumer, to obtain a client key, together with a client secret. I need these two to initiate the OAuth1 flow. Therefore the client (web application) need to have them. But that means every user of that webapp has now the client secret and key, and is able to impersonate me as a developer and luring user into phishing traps.This also applies, arguably to a lesser extend to other clients, which might first need to be disassembled. But the ultimate problem still exists.
But there must be a misunderstanding on my side, since such a problem would have surly been in the way of the wildly adoption of it.
One possibility that comes to my mind is, as a client developer, initiating OAuth only server-side. Is this the solution, or is there no such problem?