Using dynamic client registration with mobile applications

As stated by RFC 8252, native apps arestated as public clients except when using a mechanism like dynamic client registration. By using dynamic client registration (which also has it's own specification defined by RFC 7591 and can be read at https://tools.ietf.org/html/rfc7591), we create the possibility of having separate credentials for each client installation. The main advantage achieved by this approach is that it compromises just one client application instead of all client applications that may share the same credentials. It also creates the possibility to store the credentials in the memory rather than using local storage. This recipe presents you with how you can create an Android app that registers itself against the OAuth 2.0 Provider to improve the safeness of the application.

Note

Issuing an a client secret for a native client, when using dynamic client registration is not a problem regarding the Security Considerations...