OAuth oauth.net

OAuth 2.0 for Native Apps

RFC 8252 Published rfc-editor.org/rfc/rfc8252

This document describes security requirements and best practices for OAuth 2.0 in native and mobile apps — iOS, Android, and desktop applications that can't safely store a client secret.

When to use this Follow this guidance when building any native app that needs to authorize against an OAuth 2.0 server. The key recommendations: use Authorization Code + PKCE (not client credentials or Implicit), open the authorization URL in the system browser (not an embedded web view), and use platform-specific redirect URI patterns (https redirect URIs on iOS and Android, custom URI schemes on desktop).

Native apps are public clients — secrets embedded in an app binary are not secret, since they can be extracted from the app package. PKCE protects the authorization code exchange without requiring a client secret. Using the system browser (not an embedded WKWebView or WebView) is critical for security: embedded views are vulnerable to phishing since the app controls the UI around the browser and can intercept credentials.

More resources