advancedScenario Questions

Scenario 5: Your team wants to allow a mobile app to call your API using OAuth2, but the mobile app can't safely store a client_secret. What do you recommend?

Use the Authorization Code grant with PKCE, treating the mobile app as a PUBLIC client (no client_secret at all). PKCE's dynamically generated code_verifier/code_challenge pair protects the exchange without requiring a static, embeddable secret that could be extracted from the compiled app.

Ready to master this question?

Generate a complete walkthrough — background, the full answer in plain language, a working code example explained line by line, a real-world scenario, common mistakes, and how this same question gets asked in different ways.

Next Step

Continue to Scenario 6: A batch job needs to call an internal microservice API every night with no user involved. Which OAuth2 grant type fits, and how would you configure the resource server? →← Back to all Spring Security questions