title: preventing other android apps/developers making requests to my service with facebook_id and access token using OAuth2 client_id and client secret
body: <p>So i am using <strong>facebook</strong> login in my android app with facebook lite, i have an app server that i send the users <strong>facebook id</strong> and <strong>access token</strong> sent gotten from facebook, then my <strong>app server</strong> will verify the credentials on facebook and grant access to the user.</p>
  
  <p>the obvious problem is that any other app or developer can use facebook_ids and access tokens to access my app server and also authenticate, so i was thinking that i'll send my <strong>client_id and client_secret</strong> <strong>(OAuth2 implementation)</strong> along with the facebook_id and access token to my app server, as the client secret and client id are unique to my app server and shared between my app client and server.</p>
  
  <p>Just want to know thoughts on this and what's the best course of action.</p>