How do I ensure mobile apps doesn't steal user/password calling my REST API

We're developing a REST based API that developers would call from their mobile apps, e.g. google play apps.

How can we make sure that the app developer doesn't steal the users user/pass by storing them or sending them to "EvilServer".

If we do not trust the app developers, does a technical solution to this problem exist?

Could one solution be to have our own trusted authentication app on the native platform and let app developers use it to authenticate?

Solution

What I would recommend is to first remove the ability for a third-party application to log a user to your service using his credentials, so there is no reason for an app to ask for the user's credentials in the first place.

I would instead provide an OAuth authentication endpoint (take a look at the server-side flow) to third-party developers in order for them to use your authentication service to register and authenticate users in their app. This is interesting because users have to be redirected to your authentication endpoint when they log in, so there is no chance a third-party application can have access to their credentials at any point.

However, nothing prevents the developer of an evil app from creating a fake form requiring the user to provide sensitive informations in order to log them in, such as an email and a password.

In this case, you can do two things :

First, educate your users (e.g when they create their account) not to provide their credentials on any other website than yours. This is typically done by banks and insurance companies.
Implement Multi-Factor Authentication to add another layer of security to your authentication process. Most web companies such as Google or Twitter allow you to require that while providing your usual credentials when logging in, you are still required to validate the login process using an out-of-band medium. They typically achieve this by sending you a PIN code via SMS on your phone that you must input on a web page to finish the login process. As such, if someone tries to log into one of your user's account, it will fail unless they have also access to the user phone.