CODEWITHSUNDEEP
oauthoauth-2.0google-oauth
Dun Peal
Dun Peal

Reputation: 17679

Why does Google provide a client secret for a Native application?

I'm writing a native application that works against a Google API. Upon registering my application, and despite its explicit designation as Native, the Google Developers Console provides me with a client secret.

As far as I understand the OAuth 2.0 protocol, native apps should never have a client secret, since they cannot guarantee its secrecy. Is Google mistaken in its implementation of OAuth 2.0? How should I proceed?

Upvotes: 6

Views: 1446

Answers (1)

aeijdenberg
aeijdenberg

Reputation: 2457

You are correct, the client secret isn't terribly useful in a native application from a being kept secret perspective. I suspect it's there mainly for consistency with the web application flow.

It does however have at least 1 useful feature... the original developer can reset it at any time, effectively revoking all refresh tokens bound to that client ID.

Upvotes: 5

Related Questions