I'm writing a web app that prompts the user to sign in to salesforce via oauth consent so I've created a connected app in my organizations instance, and using the generated consumer key and secret key provided to do this.
It allows a user to visit the web app, visit the oauth consent screen, approve access for the web app and return with the app now having an access token.
This is good, but I realized during the OAuth process, I can sign in to any salesforce org. I tested this with another org and the process works. This is fine since I'm intending to distribute this app.
I don't understand what role the org I created the app under plays? Like I said I'm using the provided consumer key/secret keys I copied from my salesforce org from setup -> manage connected apps.
Is it ok to allow anyone to use the app? This is my intention, but I expected to have to publish the app or make it public some how.