I know at least with Google you can authenticate "cross-client": https://developers.google.com/accounts/docs/CrossClientAuth

Best writeup for Google I've found: http://www.riskcompletefailure.com/2013/10/google-android-cl... (author talks about "PlusClient" which is now deprecated in favor of "GoogleApiClient", but other than that, the article is accurate - but missing server-side details).

It's a lot harder. So I'm guessing many devs just skip it.