OAuth and obtaining shared secret securely

Question

I am building a downloadable web application, which is packaged as a ZIP archive. When downloaded webmaster is taken through installer. As one step of the installer, he is asked to "register" his copy from the main site. After registration is successful I need to issue that particular copy of my software a shared key/secret for further API access through OAuth.

Please advise the most secure and correct way to do this. Again, here are steps:

• software is downloaded (same zip for everyone, cannot contain secrets)
• webmaster opens wizard (by pointing his browser at localhost)
• wizard redirect to example.com where user enters his credential
• user is then sent back to localhost along with
  • oauth key
  • shared secret
• in the future software can access API directly through OAuth token.

Another question is can I obtain token during the initial handshake or should I perform that step later.

Answer 1

Have the web app itself perform the transaction itself, and then collect the secret directly. Don't have the users go to the external site.