It's a good question. I was listening to an Esri presentation about marketplace and oauth2 yesterday and they kept talking about one step vs two Step authorization. See two step here https://developers.arcgis.com/en/authentication/user-ios-etc.html
One step authorization being for javascript, flex apps that will expire shortly, and you don't get a refresh token. Two step being for mobile apps (or I think desktop or server apps also) where you get the refresh token and don't want to have frequent logins. When the access token expires, you can keep getting new ones with the refresh token theoretically forever and wouldn't have to login after the first time. Of course, this is a security risk if you are saving this, say as a cookie for a javascript app.
Long way around to your question, but if you don't find any more information about the interesting phrase "resources...that have been shared with the application", I wonder if it really is more about users, and not apps, having access to resources?
A mobile, server (think php server side) or desktop application can use the two step authorization with a user account, get the refresh token, save it securely and keep refreshing the access token as needed. Under this scenario, other non AGOL users would not have to login to AGOL through your app, but can access AGOL resources through your app with the one named user account that is perpetually logged in.
As an aside, I'm not sure they would let an app of this sort into their marketplace because it doesn't involve individual user having to login to AGOL. Everything I'm hearing revolves around this phrase "named user account". Esri wants to sell subscriptions to AGOL and they want people to have an account and login with it -- which makes some have conniptions, but it's just their business model.
Log in to www.arcgis.com with administrator credentials.
Click My Content, and navigate to the intended feature service. Open the feature service.
If the error, "There are no services available" is returned when visiting the ArcGIS REST Administrator Directory, the hosted feature service is shared with 'Everyone' (public).
In the item details page of the feature service, click the hyperlink under 'Layers'. The ArcGIS REST Services Directory page opens.
Modify the URL to the one displayed below, appending 'admin' to the end of the URL and deleting the rest of the URL to the service:
http://services.arcgis.com/xxxx/ArcGIS/admin
Click Enter to access the new page.
Click Services and find the intended service.
Click the service name. The URL becomes:
http://services.arcgis.com/xxxx/ArcGIS/admin/services/states.FeatureServer
Scroll to the bottom of the page, and click Update Definition.
Change the value of the lastEditDate
key to null.
Search for the maxRecordCount
parameter (Press Ctrl + F and search for 'maxRecordCount'). Change the values to the number of desired features records to display. Click Update Service Definition.
Go back to the 'My Content' page and open the feature service in a new web map. All features beyond 1000 are now included and displayed as desired.
Best Answer
Your layerUrl is similar at: http://services1.arcgis.com/cFi1BRRsYB2fYqCl/arcgis/rest/services/NameService/FeatureServer
Just add the token to Url: http://services1.arcgis.com/cFi1BRRsYB2fYqCl/arcgis/rest/services/NameService/FeatureServer?token=gGIYjUwXvaO75l1X7LHsgOo2Yueoh1jTGRvrKm7K9ZBE-0TY-EA_Ml7vJtllQK9P2nngX5ciedKgHkjLOEgRSKYR8QhDJMDpWQ09PhTWubNACuFsNIQ3fdlbS6tsPO0h