Client secret for Django oauth

Question

I an using Django OAuth Toolkit and Django Rest for OAuth authentication for mobile app. For accessing any protected resource client id and secret of the app is required . Where should I store client secret. Storing in APK is unsafe as it can be decompiled. Even obfuscation can be reverse engineered . Then whats the best and safe way to serve client secret to the app.

Answer 1

It isn't extremely important to keep the client id hidden, but you are right not to save the client secret somewhere in your app. Exposing it would definitely compromise your security.

In your case, you could set up an OAuth app that uses the Password Grant type (my personal preference), or have your user authenticate with your server which will grant them an expirey access token to use with future requests. These are two different "OAuth flows" that are common for mobile apps.

There's also this awkwardly titled slideshow which I thought had some useful illustrations to describe the use of OAuth with mobile apps.