According to the ESRI REST API documentation on authentication, a registered application can log in to AGOL via an App ID and App Secret and will then have access to the data that has been shared with it.
The server side application component that has access to the application's credentials can obtain a token using a single request. The OAuth 2 grant type is set to client_credentials. The actual POST request is made to the portal's OAuth 2 token endpoint.
client_id=APPID& client_secret=APPSECRET& grant_type=client_credentials
Successful authentication directly returns a JSON response containing the access token that allows the application to work with resources that are accessible to the application (that is, have been shared with the application). Use of the client_secret as previously described is mandatory.
In the section above they specifically mention
"resources...that have been shared with the application". I have not found anywhere in any documentation how to actually share resources with an application. How do I share a hosted feature service with a registered app so that my app can access secured services without my users logging in?