I don't think it's a flow of OAuth. It's more a software design issue here. It was wrong for them to use OAuth for this task. It's such a poor design choice (th

I don't think it's a flow of OAuth. It's more a software design issue here. It was wrong for them to use OAuth for this task. It's such a poor design choice (they repeated the error many times for all these applications) that it's hard to believe they didn't want that in the first place. As to know why they want these keys to be basically 'public', I'm not sure why yet..