Aaron Parecki

@beaugunderson Your best best is to not use the client secret, and redirect to the app's registered protocol handler. Or dynamically generate a client secret when the app first launches (unique to each app). Sounds like this would be a good blog post.