I've been trying to get my head around OAuth2 to see if anything in that is actually useful for this purposes. As far as I can see, 2-legged OAuth2 I.e. "Resource Owner Password Credentials Grant flow" is the type of flow I need, but it doesn't solve the malicious application problem.