Subject: Re: [OAUTH-WG] Flowchart for legs of OAuth
From: Marius Scurtescu <[email-masked]>
To: Kris Selden <[email-masked]>
Cc: [email-masked]
Date: Mon, 4 Apr 2011 11:29:58 -0700
List-Id: OAUTH WG <oauth.ietf.org>

On Mon, Apr 4, 2011 at 10:47 AM, Kris Selden <[email-masked]> wrote:
> A typical iPhone app cannot be shipped with a client secret and rightly or wrongly users expect to only have to enter their credentials once.
>
> What is the best profile to use for an app that can't have a client secret and needs a refresh token or a long lived access token?

The authorization code grant, aka web server flow.

The spec is misleading in this respect IMO.

Marius