Magento 2 OAuth authentication and REST API access

[timsttiiup]

It should be pointed out somewhere MORE CLEARLY in the documentation that once you have set up an integration in admin, and you have the 4 keys, there is no need to make calls to /oauth/token/request or /oauth/token/access.

I spent so much time trying to verify my already set to 'access' tokens.  Only stepping through magento core code did I stumble upon the lines that say 

$this->logger->info(
    'Request token ' . $token->getToken() . ' was exchanged to obtain access token for consumer ' . $consumerId
);

runs right after I created the Integration.

Theres no need to do anything other than that if you are integrating YOUR OWN SYSTEMS!!

[misswu]

Hi, I just tried magento2.0.4, after integration registration and activate, I get consumer key, consumer secret, access token and access token secret. With these information, I can access the APIs. But the official document   mentions 2-legged Oauth Handshake which seems useless. Is the document out-dated, or I have not gotten the key.

If I use OAuth-based authentication in a mobile app, It seems I have to hardcode the access token into it. And this is not secure, because others can reverse app and get the token to access the APIs.

Please help me, thank you!