In this case, you will need a mechanism for checking tokens from the application services gateway. API applications receive their tokens verified by the gateway itself, but other sites (web applications and mobile applications) do not receive such assistance.
( -) SDK Mobile Apps Server, , , ( , , Mobile SDK -, ).
Mobile SDK -, MS_SigningKey . , "Gateway Host" .