Scenario 5: Your team wants to allow a mobile app to call your API using OAuth2, but the mobile app can't safely store a client_secret. What do you recommend?

Use the Authorization Code grant with PKCE, treating the mobile app as a PUBLIC client (no client_secret at all). PKCE's dynamically generated code_verifier/code_challenge pair protects the exchange without requiring a static, embeddable secret that could be extracted from the compiled app.