The Facebook application on Android probably verifies the integrity of the app originating the request by checking its code signature. Developers have to register their Android code signing certificate with Facebook.

The process is described here: https://developers.facebook.com/docs/android/getting-started...

The Facebook app for Android is closed source; however, the Facebook Android SDK seems to verify requests from the Facebook app in a similar way: https://github.com/facebook/facebook-android-sdk/blob/master...

I imagine that it works like that the other way around as well: Check whether the code signature of the Intent's sender matches the app developer certificate.