> No. Any authentication situation where every end user needs to protect a secret shared among many end users is fundamentally broken. That's not the same as wh

> No. Any authentication situation where every end user needs to protect a secret shared among many end users is fundamentally broken. That's not the same as what you just said. OK, I was imprecise in my language. You clarified what I meant. > This problem absolutely does not require a PKI to solve. How would you solve it for native apps? By "it" I mean enabling the API to be sure that user X submitted the request with app developer Y's real client. Without having the app developer sign something for every user downloading the client, or running a proxy.