OAuth 2.1 on Mobile (with PKCE)

Instructions

Mobile OAuth is a minefield. Use audited libraries, follow RFC 8252 (OAuth 2.0 for Native Apps), and never hand-roll the flow.

1. Allowed Flows

• Authorization Code + PKCE — the only acceptable interactive flow for native apps (RFC 7636).
• Device Authorization Grant — acceptable for input-constrained devices (TVs, some wearables).
• Client Credentials — only for server-to-server. Never ship a client secret in a mobile binary.

Banned on mobile:

• Implicit flow (returns access tokens in the URL fragment — can leak).
• Resource Owner Password Credentials ("password grant") — the app sees the user's password.
• Any flow that relies on a confidential client_secret baked into the app.

2. PKCE — What the Client Does